]>
Commit | Line | Data |
---|---|---|
47f38bc9 GKH |
1 | From foo@baz Fri Sep 21 09:36:02 CEST 2018 |
2 | From: Krzysztof Ha?asa <khalasa@piap.pl> | |
3 | Date: Thu, 28 Jun 2018 17:45:07 -0400 | |
4 | Subject: media: tw686x: Fix oops on buffer alloc failure | |
5 | ||
6 | From: Krzysztof Ha?asa <khalasa@piap.pl> | |
7 | ||
8 | [ Upstream commit 5a1a2f63d840dc2631505b607e11ff65ac1b7d3c ] | |
9 | ||
10 | The error path currently calls tw686x_video_free() which requires | |
11 | vc->dev to be initialized, causing a NULL dereference on uninitizalized | |
12 | channels. | |
13 | ||
14 | Fix this by setting the vc->dev fields for all the channels first. | |
15 | ||
16 | Fixes: f8afaa8dbc0d ("[media] tw686x: Introduce an interface to support multiple DMA modes") | |
17 | ||
18 | Signed-off-by: Krzysztof Ha?asa <khalasa@piap.pl> | |
19 | Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> | |
20 | Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org> | |
21 | Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> | |
22 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | |
23 | --- | |
24 | drivers/media/pci/tw686x/tw686x-video.c | 11 ++++++++--- | |
25 | 1 file changed, 8 insertions(+), 3 deletions(-) | |
26 | ||
27 | --- a/drivers/media/pci/tw686x/tw686x-video.c | |
28 | +++ b/drivers/media/pci/tw686x/tw686x-video.c | |
29 | @@ -1190,6 +1190,14 @@ int tw686x_video_init(struct tw686x_dev | |
30 | return err; | |
31 | } | |
32 | ||
33 | + /* Initialize vc->dev and vc->ch for the error path */ | |
34 | + for (ch = 0; ch < max_channels(dev); ch++) { | |
35 | + struct tw686x_video_channel *vc = &dev->video_channels[ch]; | |
36 | + | |
37 | + vc->dev = dev; | |
38 | + vc->ch = ch; | |
39 | + } | |
40 | + | |
41 | for (ch = 0; ch < max_channels(dev); ch++) { | |
42 | struct tw686x_video_channel *vc = &dev->video_channels[ch]; | |
43 | struct video_device *vdev; | |
44 | @@ -1198,9 +1206,6 @@ int tw686x_video_init(struct tw686x_dev | |
45 | spin_lock_init(&vc->qlock); | |
46 | INIT_LIST_HEAD(&vc->vidq_queued); | |
47 | ||
48 | - vc->dev = dev; | |
49 | - vc->ch = ch; | |
50 | - | |
51 | /* default settings */ | |
52 | err = tw686x_set_standard(vc, V4L2_STD_NTSC); | |
53 | if (err) |