summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorKrzysztof Ha?asa <khalasa@piap.pl>2018-06-28 17:45:07 -0400
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2018-09-26 08:36:31 +0200
commit8992a70297ed01f7c898f854b1edcf4a0ad4521c (patch)
tree478a9256b5c520c556559b4c12f0a33e30d3133f
parent48a90a9e56a37d9b0fbc81ca08411c84040d5918 (diff)
downloadlinux-stable-8992a70297ed01f7c898f854b1edcf4a0ad4521c.tar.gz
linux-stable-8992a70297ed01f7c898f854b1edcf4a0ad4521c.tar.bz2
linux-stable-8992a70297ed01f7c898f854b1edcf4a0ad4521c.zip
media: tw686x: Fix oops on buffer alloc failure
[ Upstream commit 5a1a2f63d840dc2631505b607e11ff65ac1b7d3c ] The error path currently calls tw686x_video_free() which requires vc->dev to be initialized, causing a NULL dereference on uninitizalized channels. Fix this by setting the vc->dev fields for all the channels first. Fixes: f8afaa8dbc0d ("[media] tw686x: Introduce an interface to support multiple DMA modes") Signed-off-by: Krzysztof Ha?asa <khalasa@piap.pl> Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org> Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-rw-r--r--drivers/media/pci/tw686x/tw686x-video.c11
1 files changed, 8 insertions, 3 deletions
diff --git a/drivers/media/pci/tw686x/tw686x-video.c b/drivers/media/pci/tw686x/tw686x-video.c
index 0ea8dd44026c..3a06c000f97b 100644
--- a/drivers/media/pci/tw686x/tw686x-video.c
+++ b/drivers/media/pci/tw686x/tw686x-video.c
@@ -1190,6 +1190,14 @@ int tw686x_video_init(struct tw686x_dev *dev)
return err;
}
+ /* Initialize vc->dev and vc->ch for the error path */
+ for (ch = 0; ch < max_channels(dev); ch++) {
+ struct tw686x_video_channel *vc = &dev->video_channels[ch];
+
+ vc->dev = dev;
+ vc->ch = ch;
+ }
+
for (ch = 0; ch < max_channels(dev); ch++) {
struct tw686x_video_channel *vc = &dev->video_channels[ch];
struct video_device *vdev;
@@ -1198,9 +1206,6 @@ int tw686x_video_init(struct tw686x_dev *dev)
spin_lock_init(&vc->qlock);
INIT_LIST_HEAD(&vc->vidq_queued);
- vc->dev = dev;
- vc->ch = ch;
-
/* default settings */
err = tw686x_set_standard(vc, V4L2_STD_NTSC);
if (err)