lkml.org 
[lkml]   [2020]   [Jan]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.19 281/639] media: tw5864: Fix possible NULL pointer dereference in tw5864_handle_frame
    Date
    From: YueHaibing <yuehaibing@huawei.com>

    [ Upstream commit 2e7682ebfc750177a4944eeb56e97a3f05734528 ]

    'vb' null check should be done before dereferencing it in
    tw5864_handle_frame, otherwise a NULL pointer dereference
    may occur.

    Fixes: 34d1324edd31 ("[media] pci: Add tw5864 driver")

    Signed-off-by: YueHaibing <yuehaibing@huawei.com>
    Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
    Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/media/pci/tw5864/tw5864-video.c | 4 ++--
    1 file changed, 2 insertions(+), 2 deletions(-)

    diff --git a/drivers/media/pci/tw5864/tw5864-video.c b/drivers/media/pci/tw5864/tw5864-video.c
    index ff2b7da90c088..6c40e60ac9939 100644
    --- a/drivers/media/pci/tw5864/tw5864-video.c
    +++ b/drivers/media/pci/tw5864/tw5864-video.c
    @@ -1395,13 +1395,13 @@ static void tw5864_handle_frame(struct tw5864_h264_frame *frame)
    input->vb = NULL;
    spin_unlock_irqrestore(&input->slock, flags);

    - v4l2_buf = to_vb2_v4l2_buffer(&vb->vb.vb2_buf);
    -
    if (!vb) { /* Gone because of disabling */
    dev_dbg(&dev->pci->dev, "vb is empty, dropping frame\n");
    return;
    }

    + v4l2_buf = to_vb2_v4l2_buffer(&vb->vb.vb2_buf);
    +
    /*
    * Check for space.
    * Mind the overhead of startcode emulation prevention.
    --
    2.20.1


    \
     
     \ /
      Last update: 2020-01-24 12:17    [W:4.120 / U:0.816 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site