From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Tue, 13 Mar 2012 19:31:32 +0000 (-0700)
Subject: 3.2-stable patches
X-Git-Tag: v3.0.25~22
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=c79448a4787a2382c9cdaa33f55883f84304c60e;p=thirdparty%2Fkernel%2Fstable-queue.git

3.2-stable patches

added patches:
	omap3isp-ccdc-fix-crash-in-hs-vs-interrupt-handler.patch
---

diff --git a/queue-3.2/omap3isp-ccdc-fix-crash-in-hs-vs-interrupt-handler.patch b/queue-3.2/omap3isp-ccdc-fix-crash-in-hs-vs-interrupt-handler.patch
new file mode 100644
index 00000000000..83f35e24c4d
--- /dev/null
+++ b/queue-3.2/omap3isp-ccdc-fix-crash-in-hs-vs-interrupt-handler.patch
@@ -0,0 +1,38 @@
+From bd0f2e6da7ea9e225cb2dbd3229e25584b0e9538 Mon Sep 17 00:00:00 2001
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Date: Fri, 11 Nov 2011 11:22:20 -0300
+Subject: [media] omap3isp: ccdc: Fix crash in HS/VS interrupt handler
+
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+
+commit bd0f2e6da7ea9e225cb2dbd3229e25584b0e9538 upstream.
+
+The HS/VS interrupt handler needs to access the pipeline object. It
+erronously tries to get it from the CCDC output video node, which isn't
+necessarily included in the pipeline. This leads to a NULL pointer
+dereference.
+
+Fix the bug by getting the pipeline object from the CCDC subdev entity.
+
+Reported-by: Gary Thomas <gary@mlbassoc.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Acked-by: Sakari Ailus <sakari.ailus@iki.fi>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/video/omap3isp/ispccdc.c |    3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/media/video/omap3isp/ispccdc.c
++++ b/drivers/media/video/omap3isp/ispccdc.c
+@@ -1406,8 +1406,7 @@ static int __ccdc_handle_stopping(struct
+ 
+ static void ccdc_hs_vs_isr(struct isp_ccdc_device *ccdc)
+ {
+-	struct isp_pipeline *pipe =
+-		to_isp_pipeline(&ccdc->video_out.video.entity);
++	struct isp_pipeline *pipe = to_isp_pipeline(&ccdc->subdev.entity);
+ 	struct video_device *vdev = ccdc->subdev.devnode;
+ 	struct v4l2_event event;
+ 
diff --git a/queue-3.2/series b/queue-3.2/series
index c0f74d8d2dc..53c21f7e65b 100644
--- a/queue-3.2/series
+++ b/queue-3.2/series
@@ -4,3 +4,4 @@ aio-fix-io_setup-io_destroy-race.patch
 aio-fix-the-too-late-munmap-race.patch
 x86-derandom-delay_tsc-for-64-bit.patch
 pci-ignore-pre-1.1-aspm-quirking-when-aspm-is-disabled.patch
+omap3isp-ccdc-fix-crash-in-hs-vs-interrupt-handler.patch