git.ipfire.org Git - thirdparty/kernel/stable-queue.git/blob

   1 From foo@baz Thu Mar 22 14:03:39 CET 2018
   2 From: "Gustavo A. R. Silva" <garsilva@embeddedor.com>
   3 Date: Mon, 20 Nov 2017 09:00:55 -0500
   4 Subject: media: c8sectpfe: fix potential NULL pointer dereference in c8sectpfe_timer_interrupt
   5
   6 From: "Gustavo A. R. Silva" <garsilva@embeddedor.com>
   7
   8
   9 [ Upstream commit baed3c4bc4c13de93e0dba0a26d601411ebcb389 ]
  10
  11 _channel_ is being dereferenced before it is null checked, hence there is a
  12 potential null pointer dereference. Fix this by moving the pointer dereference
  13 after _channel_ has been null checked.
  14
  15 This issue was detected with the help of Coccinelle.
  16
  17 Fixes: c5f5d0f99794 ("[media] c8sectpfe: STiH407/10 Linux DVB demux support")
  18
  19 Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com>
  20 Acked-by: Patrice Chotard <patrice.chotard@st.com>
  21 Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
  22 Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
  23 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  24 ---
  25  drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c |    4 +++-
  26  1 file changed, 3 insertions(+), 1 deletion(-)
  27
  28 --- a/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c
  29 +++ b/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c
  30 @@ -83,7 +83,7 @@ static void c8sectpfe_timer_interrupt(st
  31  static void channel_swdemux_tsklet(unsigned long data)
  32  {
  33         struct channel_info *channel = (struct channel_info *)data;
  34 -       struct c8sectpfei *fei = channel->fei;
  35 +       struct c8sectpfei *fei;
  36         unsigned long wp, rp;
  37         int pos, num_packets, n, size;
  38         u8 *buf;
  39 @@ -91,6 +91,8 @@ static void channel_swdemux_tsklet(unsig
  40         if (unlikely(!channel || !channel->irec))
  41                 return;
  42
  43 +       fei = channel->fei;
  44 +
  45         wp = readl(channel->irec + DMA_PRDS_BUSWP_TP(0));
  46         rp = readl(channel->irec + DMA_PRDS_BUSRP_TP(0));
  47