diff options
author | Alexey Khoroshilov <khoroshilov@ispras.ru> | 2013-07-03 15:17:34 -0400 |
---|---|---|
committer | Mauro Carvalho Chehab <m.chehab@samsung.com> | 2013-09-03 08:24:20 -0400 |
commit | 2e923a0527ac439e135b9961e58d3acd876bba10 (patch) | |
tree | 7db98a5de65711cf9f6c6b28f404ab8076d52ba7 /drivers/media | |
parent | 6ee0faa52676ab648e486afb654fc92313d55943 (diff) |
[media] hdpvr: fix iteration over uninitialized lists in hdpvr_probe()
free_buff_list and rec_buff_list are initialized in the middle of hdpvr_probe(),
but if something bad happens before that, error handling code calls hdpvr_delete(),
which contains iteration over the lists (via hdpvr_free_buffers()).
The patch moves the lists initialization to the beginning and by the way fixes
goto label in error handling of registering videodev.
Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
Cc: stable@vger.kernel.org
Diffstat (limited to 'drivers/media')
-rw-r--r-- | drivers/media/usb/hdpvr/hdpvr-core.c | 11 |
1 files changed, 6 insertions, 5 deletions
diff --git a/drivers/media/usb/hdpvr/hdpvr-core.c b/drivers/media/usb/hdpvr/hdpvr-core.c index cb694055ba7d..6e5070774dc2 100644 --- a/drivers/media/usb/hdpvr/hdpvr-core.c +++ b/drivers/media/usb/hdpvr/hdpvr-core.c | |||
@@ -303,6 +303,11 @@ static int hdpvr_probe(struct usb_interface *interface, | |||
303 | 303 | ||
304 | dev->workqueue = 0; | 304 | dev->workqueue = 0; |
305 | 305 | ||
306 | /* init video transfer queues first of all */ | ||
307 | /* to prevent oops in hdpvr_delete() on error paths */ | ||
308 | INIT_LIST_HEAD(&dev->free_buff_list); | ||
309 | INIT_LIST_HEAD(&dev->rec_buff_list); | ||
310 | |||
306 | /* register v4l2_device early so it can be used for printks */ | 311 | /* register v4l2_device early so it can be used for printks */ |
307 | if (v4l2_device_register(&interface->dev, &dev->v4l2_dev)) { | 312 | if (v4l2_device_register(&interface->dev, &dev->v4l2_dev)) { |
308 | dev_err(&interface->dev, "v4l2_device_register failed\n"); | 313 | dev_err(&interface->dev, "v4l2_device_register failed\n"); |
@@ -325,10 +330,6 @@ static int hdpvr_probe(struct usb_interface *interface, | |||
325 | if (!dev->workqueue) | 330 | if (!dev->workqueue) |
326 | goto error; | 331 | goto error; |
327 | 332 | ||
328 | /* init video transfer queues */ | ||
329 | INIT_LIST_HEAD(&dev->free_buff_list); | ||
330 | INIT_LIST_HEAD(&dev->rec_buff_list); | ||
331 | |||
332 | dev->options = hdpvr_default_options; | 333 | dev->options = hdpvr_default_options; |
333 | 334 | ||
334 | if (default_video_input < HDPVR_VIDEO_INPUTS) | 335 | if (default_video_input < HDPVR_VIDEO_INPUTS) |
@@ -405,7 +406,7 @@ static int hdpvr_probe(struct usb_interface *interface, | |||
405 | video_nr[atomic_inc_return(&dev_nr)]); | 406 | video_nr[atomic_inc_return(&dev_nr)]); |
406 | if (retval < 0) { | 407 | if (retval < 0) { |
407 | v4l2_err(&dev->v4l2_dev, "registering videodev failed\n"); | 408 | v4l2_err(&dev->v4l2_dev, "registering videodev failed\n"); |
408 | goto error; | 409 | goto reg_fail; |
409 | } | 410 | } |
410 | 411 | ||
411 | /* let the user know what node this device is now attached to */ | 412 | /* let the user know what node this device is now attached to */ |