]> git.ipfire.org Git - thirdparty/kernel/stable.git/commitdiff
media: cx18: Add missing check after DMA map
authorThomas Fourier <fourier.thomas@gmail.com>
Fri, 17 Oct 2025 13:55:39 +0000 (09:55 -0400)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 29 Oct 2025 12:59:56 +0000 (13:59 +0100)
[ Upstream commit 23b53639a793477326fd57ed103823a8ab63084f ]

The DMA map functions can fail and should be tested for errors.
If the mapping fails, dealloc buffers, and return.

Fixes: 1c1e45d17b66 ("V4L/DVB (7786): cx18: new driver for the Conexant CX23418 MPEG encoder chip")
Cc: stable@vger.kernel.org
Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
[ removed pci_map_single() replaced by dma_map_single() ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/media/pci/cx18/cx18-queue.c

index 2f5df471dada6dd37762fa21db40ac1eeb7d1af4..9b247ecf48d5c13d218c542ebf901d7ca3f6eb13 100644 (file)
@@ -379,14 +379,22 @@ int cx18_stream_alloc(struct cx18_stream *s)
                        break;
                }
 
+               buf->dma_handle = dma_map_single(&s->cx->pci_dev->dev,
+                                                buf->buf, s->buf_size,
+                                                s->dma);
+               if (dma_mapping_error(&s->cx->pci_dev->dev, buf->dma_handle)) {
+                       kfree(buf->buf);
+                       kfree(mdl);
+                       kfree(buf);
+                       break;
+               }
+
                INIT_LIST_HEAD(&mdl->list);
                INIT_LIST_HEAD(&mdl->buf_list);
                mdl->id = s->mdl_base_idx; /* a somewhat safe value */
                cx18_enqueue(s, mdl, &s->q_idle);
 
                INIT_LIST_HEAD(&buf->list);
-               buf->dma_handle = pci_map_single(s->cx->pci_dev,
-                               buf->buf, s->buf_size, s->dma);
                cx18_buf_sync_for_cpu(s, buf);
                list_add_tail(&buf->list, &s->buf_pool);
        }