]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
media: cx18: Fix invalid access to file *
authorJacopo Mondi <jacopo.mondi@ideasonboard.com>
Tue, 14 Oct 2025 13:19:33 +0000 (15:19 +0200)
committerHans Verkuil <hverkuil+cisco@kernel.org>
Tue, 14 Oct 2025 13:53:37 +0000 (15:53 +0200)
commit512f0b7ebbc79d97d9485cd055902d439237e91f
treef44fdcd8f4eae9cad07e8d8a9fbc98cfa252c1e0
parent3a8660878839faadb4f1a6dd72c3179c1df56787
media: cx18: Fix invalid access to file *

Sice commit 7b9eb53e8591 ("media: cx18: Access v4l2_fh from file")
all ioctl handlers have been ported to operate on the file * first
function argument.

The cx18 DVB layer calls cx18_init_on_first_open() when the driver needs
to start streaming. This function calls the s_input(), s_std() and
s_frequency() ioctl handlers directly, but being called from the driver
context, it doesn't have a valid file * to pass them. This causes
the ioctl handlers to deference an invalid pointer.

Fix this by moving the implementation of those ioctls to functions that
take a cx18 pointer instead of a file pointer, and turn the V4L2 ioctl
handlers into wrappers that get the cx18 from the file. When calling
from cx18_init_on_first_open(), pass the cx18 pointer directly. This
allows removing the fake fh in cx18_init_on_first_open().

The bug has been reported by Smatch:

--> 1223         cx18_s_input(NULL, &fh, video_input);
The patch adds a new dereference of "file" but some of the callers pass a
NULL pointer.

Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Closes: https://lore.kernel.org/all/aKL4OMWsESUdX8KQ@stanley.mountain/
Fixes: 7b9eb53e8591 ("media: cx18: Access v4l2_fh from file")
Cc: stable@vger.kernel.org
Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Tested-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
drivers/media/pci/cx18/cx18-driver.c
drivers/media/pci/cx18/cx18-ioctl.c
drivers/media/pci/cx18/cx18-ioctl.h