Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 07c87a83 authored by Andy Walls's avatar Andy Walls Committed by Mauro Carvalho Chehab
Browse files

V4L/DVB (7891): cx18/ivtv: fix open() kernel oops 



Upon error conditions in cx18/ivtv_probe(), the code at the 'err:' label
leaves a NULL entry in cx18/ivtv_cards[]. This can cause a NULL pointer
de-reference in cx18/ivtv_v4l2_open() which is fixed by this patch.

Signed-off-by: default avatarAndy Walls <awalls@radix.net>
Signed-off-by: default avatarHans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@infradead.org>
parent cba627a5

drivers/media/video/cx18/cx18-fileops.c

+2 −0
Original line number Diff line number Diff line
@@ -662,6 +662,8 @@ int cx18_v4l2_open(struct inode *inode, struct file *filp) 
	for (x = 0; cx == NULL && x < cx18_cards_active; x++) {

		/* find out which stream this open was on */

		for (y = 0; y < CX18_MAX_STREAMS; y++) {

			if (cx18_cards[x] == NULL)

				continue;

			s = &cx18_cards[x]->streams[y];

			if (s->v4l2dev && s->v4l2dev->minor == minor) {

				cx = cx18_cards[x];

drivers/media/video/ivtv/ivtv-fileops.c

+2 −0
Original line number Diff line number Diff line
@@ -987,6 +987,8 @@ int ivtv_v4l2_open(struct inode *inode, struct file *filp) 
	/* Find which card this open was on */

	spin_lock(&ivtv_cards_lock);

	for (x = 0; itv == NULL && x < ivtv_cards_active; x++) {

		if (ivtv_cards[x] == NULL)

			continue;

		/* find out which stream this open was on */

		for (y = 0; y < IVTV_MAX_STREAMS; y++) {

			s = &ivtv_cards[x]->streams[y];