Merge "media: dvb: protect against invalid filter dereference" (71d0627e) · Commits · e / devices / android_kernel_sony_msm8994

drivers/media/dvb-core/dmxdev.c

+27 −1

Original line number	Diff line number	Diff line
		@@ -4,7 +4,7 @@
		* Copyright (C) 2000 Ralph Metzler & Marcus Metzler
		* for convergence integrated media GmbH
		*
		* Copyright (c) 2012-2014, The Linux Foundation. All rights reserved.
		* Copyright (c) 2012-2015, The Linux Foundation. All rights reserved.
		*
		* This program is free software; you can redistribute it and/or
		* modify it under the terms of the GNU Lesser General Public License
		@@ -2604,6 +2604,11 @@ static int dvb_dmxdev_section_callback(const u8 *buffer1, size_t buffer1_len,
		struct dmx_filter_event event;
		ssize_t free;

		if (!dmxdevfilter) {
		pr_err("%s: null filter. status=%d\n", __func__, success);
		return -EINVAL;
		}

		spin_lock(&dmxdevfilter->dev->lock);

		if (dmxdevfilter->buffer.error \|\|
		@@ -2685,6 +2690,12 @@ static int dvb_dmxdev_ts_callback(const u8 *buffer1, size_t buffer1_len,
		struct dmx_filter_event event;
		ssize_t free;

		if (!dmxdevfilter) {
		pr_err("%s: null filter (feed->is_filtering=%d) status=%d\n",
		__func__, feed->is_filtering, success);
		return -EINVAL;
		}

		spin_lock(&dmxdevfilter->dev->lock);

		if (dmxdevfilter->params.pes.output == DMX_OUT_DECODER \|\|
		@@ -2785,6 +2796,13 @@ static int dvb_dmxdev_section_event_cb(struct dmx_section_filter *filter,
		struct dmx_filter_event event;
		ssize_t free;

		if (!dmxdevfilter) {
		pr_err("%s: null filter. event type=%d (length=%d) will be discarded\n",
		__func__, dmx_data_ready->status,
		dmx_data_ready->data_length);
		return -EINVAL;
		}

		spin_lock(&dmxdevfilter->dev->lock);

		if (dmxdevfilter->buffer.error == -ETIMEDOUT \|\|
		@@ -2869,6 +2887,14 @@ static int dvb_dmxdev_ts_event_cb(struct dmx_ts_feed *feed,
		struct dmx_filter_event event;
		ssize_t free;

		if (!dmxdevfilter) {
		pr_err("%s: null filter (feed->is_filtering=%d) event type=%d (length=%d) will be discarded\n",
		__func__, feed->is_filtering,
		dmx_data_ready->status,
		dmx_data_ready->data_length);
		return -EINVAL;
		}

		spin_lock(&dmxdevfilter->dev->lock);

		if (dmxdevfilter->state != DMXDEV_STATE_GO \|\|