[patch] Re: V4L bug report - oops: video_register_device (ksymoops, objdump)

[Gerd Knorr <kraxel@bytesex.org>]

On Wed, May 05, 2004 at 02:20:32AM +0200, degerrit@web.de wrote:
> I caused an oops in unusual circumstances by accidentally "forcing" a
> video device number which was too high or already taken (don't know
> which). I assume this probably shouldn't give an oops (though it was my
> fault), so here's a bugreport...

Fixed by adding a range check for the number passed in by the driver.
The fix applies to 2.4 kernels as well.

  Gerd

--- linux-2.6.6-rc2/drivers/media/video/videodev.c~	2004-04-21 15:05:10.000000000 +0200
+++ linux-2.6.6-rc2/drivers/media/video/videodev.c	2004-05-05 09:38:20.032625621 +0200
@@ -316,7 +316,14 @@
 
 	/* pick a minor number */
 	down(&videodev_lock);
-	if (-1 == nr) {
+	if (nr >= 0  &&  nr < end-base) {
+		/* use the one the driver asked for */
+		i = base+nr;
+		if (NULL != video_device[i]) {
+			up(&videodev_lock);
+			return -ENFILE;
+		}
+	} else {
 		/* use first free */
 		for(i=base;i<end;i++)
 			if (NULL == video_device[i])
@@ -325,13 +332,6 @@
 			up(&videodev_lock);
 			return -ENFILE;
 		}
-	} else {
-		/* use the one the driver asked for */
-		i = base+nr;
-		if (NULL != video_device[i]) {
-			up(&videodev_lock);
-			return -ENFILE;
-		}
 	}
 	video_device[i]=vfd;
 	vfd->minor=i;