msm: camera: common: Fix possible dereference of NULL pointer

Null pointer 'flush_args.flush_req_pending' may be dereferenced,
this change add check snippet before the dereference.

CRs-Fixed: 3250285
Change-Id: I1170a291e7d0d986abe2d5909e6c328e248e4d27
Signed-off-by: Stark Lin <[email protected]>
Signed-off-by: Depeng Shao <[email protected]>

drivers/cam_core/cam_context_utils.c

@@ -793,7 +793,7 @@ int32_t cam_context_flush_ctx_to_hw(struct cam_context *ctx)
 		}
 	}
 
-	while (true) {
+	while (num_entries) {
 
 		if (list_empty(&temp_list))
 			break;
@@ -874,10 +874,11 @@ int32_t cam_context_flush_ctx_to_hw(struct cam_context *ctx)
 				rc = -ENOMEM;
 				goto end;
 			}
-		}
-		list_for_each_entry(req, &temp_list, list) {
-			flush_args.flush_req_active[flush_args.num_req_active++]
-				= req->req_priv;
+
+			list_for_each_entry(req, &temp_list, list) {
+				flush_args.flush_req_active[flush_args.num_req_active++] =
+					req->req_priv;
+			}
 		}
 
 		if (flush_args.num_req_pending || flush_args.num_req_active) {
@@ -893,7 +894,7 @@ int32_t cam_context_flush_ctx_to_hw(struct cam_context *ctx)
 			"[%s][%d] : Moving all requests from active_list to temp_list",
 			ctx->dev_name, ctx->ctx_id);
 
-	while (true) {
+	while (num_entries) {
 
 		if (list_empty(&temp_list))
 			break;