dect/linux-2.6
Archived
14
0
Fork 0
Code Releases Activity

[media] V4L: sh_mobile_ceu_camera: fix Oops when USERPTR mapping fails

Browse source 
If vb2_dma_contig_get_userptr() fails on a videobuffer, driver's
.buf_init() method will not be called and the list will not be
initialised. Trying to remove an uninitialised element from a list leads
to a NULL-dereference.

Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
Tested-by: Bastian Hecht <hechtb@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
This commit is contained in:
Guennadi Liakhovetski 2011-07-04 12:15:14 -03:00 committed by Mauro Carvalho Chehab
parent 7dfff95366
commit cb74cf5349
1 changed files with 6 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
drivers/media/video/sh_mobile_ceu_camera.c
View file

@ -422,8 +422,12 @@ static void sh_mobile_ceu_videobuf_release(struct vb2_buffer *vb)
pcdev->active = NULL;
}
/* Doesn't hurt also if the list is empty */
list_del_init(&buf->queue);
/*
* Doesn't hurt also if the list is empty, but it hurts, if queuing the
* buffer failed, and .buf_init() hasn't been called
*/
if (buf->queue.next)
list_del_init(&buf->queue);
spin_unlock_irq(&pcdev->lock);
}