raspi/linux
1
0
Fork 1
mirror of https://github.com/raspberrypi/linux.git synced 2025-12-06 10:00:17 +00:00
Code Issues Projects Releases Wiki Activity

media: tw686x: Fix oops on buffer alloc failure

Browse Source 
The error path currently calls tw686x_video_free() which requires
vc->dev to be initialized, causing a NULL dereference on uninitizalized
channels.

Fix this by setting the vc->dev fields for all the channels first.

Fixes: f8afaa8dbc ("[media] tw686x: Introduce an interface to support multiple DMA modes")

Signed-off-by: Krzysztof Ha?asa <khalasa@piap.pl>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
This commit is contained in:
Krzysztof Ha?asa
2018-06-28 17:45:07 -04:00
committed by Mauro Carvalho Chehab
parent acbea67989
commit 5a1a2f63d8
1 changed files with 8 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
drivers/media/pci/tw686x/tw686x-video.c
View File

@@ -1190,6 +1190,14 @@ int tw686x_video_init(struct tw686x_dev *dev)
return err; return err;
} }
/* Initialize vc->dev and vc->ch for the error path */
for (ch = 0; ch < max_channels(dev); ch++) {
struct tw686x_video_channel *vc = &dev->video_channels[ch];
vc->dev = dev;
vc->ch = ch;
}
for (ch = 0; ch < max_channels(dev); ch++) { for (ch = 0; ch < max_channels(dev); ch++) {
struct tw686x_video_channel *vc = &dev->video_channels[ch]; struct tw686x_video_channel *vc = &dev->video_channels[ch];
struct video_device *vdev; struct video_device *vdev;
@@ -1198,9 +1206,6 @@ int tw686x_video_init(struct tw686x_dev *dev)
spin_lock_init(&vc->qlock); spin_lock_init(&vc->qlock);
INIT_LIST_HEAD(&vc->vidq_queued); INIT_LIST_HEAD(&vc->vidq_queued);
vc->dev = dev;
vc->ch = ch;
/* default settings */ /* default settings */
err = tw686x_set_standard(vc, V4L2_STD_NTSC); err = tw686x_set_standard(vc, V4L2_STD_NTSC);
if (err) if (err)