[PATCH - stable v3.2] omap3isp: ccdc: Fix crash in HS/VS interrupt handler

[PATCH - stable v3.2] omap3isp: ccdc: Fix crash in HS/VS interrupt handler

[Laurent Pinchart]

The HS/VS interrupt handler needs to access the pipeline object. It
erronously tries to get it from the CCDC output video node, which isn't
necessarily included in the pipeline. This leads to a NULL pointer
dereference.

Fix the bug by getting the pipeline object from the CCDC subdev entity.

The upstream commit ID is bcf45117d10140852fcdc2bfd36221dc8b996025.

Reported-by: Gary Thomas <gary@mlbassoc.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Acked-by: Sakari Ailus <sakari.ailus@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
---
 drivers/media/video/omap3isp/ispccdc.c |    3 +--
 1 files changed, 1 insertions(+), 2 deletions(-)

diff --git a/drivers/media/video/omap3isp/ispccdc.c b/drivers/media/video/omap3isp/ispccdc.c
index 54a4a3f..a319281 100644
--- a/drivers/media/video/omap3isp/ispccdc.c
+++ b/drivers/media/video/omap3isp/ispccdc.c
@@ -1406,8 +1406,7 @@ static int __ccdc_handle_stopping(struct isp_ccdc_device *ccdc, u32 event)
 
 static void ccdc_hs_vs_isr(struct isp_ccdc_device *ccdc)
 {
-	struct isp_pipeline *pipe =
-		to_isp_pipeline(&ccdc->video_out.video.entity);
+	struct isp_pipeline *pipe = to_isp_pipeline(&ccdc->subdev.entity);
 	struct video_device *vdev = ccdc->subdev.devnode;
 	struct v4l2_event event;
 
-- 
Regards,

Laurent Pinchart

Re: [PATCH - stable v3.2] omap3isp: ccdc: Fix crash in HS/VS interrupt handler

[Greg KH]

On Sun, Mar 11, 2012 at 01:07:43PM +0100, Laurent Pinchart wrote:
> The HS/VS interrupt handler needs to access the pipeline object. It
> erronously tries to get it from the CCDC output video node, which isn't
> necessarily included in the pipeline. This leads to a NULL pointer
> dereference.
> 
> Fix the bug by getting the pipeline object from the CCDC subdev entity.
> 
> The upstream commit ID is bcf45117d10140852fcdc2bfd36221dc8b996025.

In what tree?  I don't see that id in Linus's tree, are you sure you got
it correct?

confused,

greg k-h

Re: [PATCH - stable v3.2] omap3isp: ccdc: Fix crash in HS/VS interrupt handler

[Laurent Pinchart]

Hi Greg,

On Tuesday 13 March 2012 11:07:53 Greg KH wrote:
> On Sun, Mar 11, 2012 at 01:07:43PM +0100, Laurent Pinchart wrote:
> > The HS/VS interrupt handler needs to access the pipeline object. It
> > erronously tries to get it from the CCDC output video node, which isn't
> > necessarily included in the pipeline. This leads to a NULL pointer
> > dereference.
> > 
> > Fix the bug by getting the pipeline object from the CCDC subdev entity.
> > 
> > The upstream commit ID is bcf45117d10140852fcdc2bfd36221dc8b996025.
> 
> In what tree?  I don't see that id in Linus's tree, are you sure you got
> it correct?
> 
> confused,

I must have been confused as well :-/

The upstream commit ID is bd0f2e6da7ea9e225cb2dbd3229e25584b0e9538. Sorry for 
the mistake.

-- 
Regards,

Laurent Pinchart

Re: [PATCH - stable v3.2] omap3isp: ccdc: Fix crash in HS/VS interrupt handler

[Greg KH]

On Tue, Mar 13, 2012 at 07:20:11PM +0100, Laurent Pinchart wrote:
> Hi Greg,
> 
> On Tuesday 13 March 2012 11:07:53 Greg KH wrote:
> > On Sun, Mar 11, 2012 at 01:07:43PM +0100, Laurent Pinchart wrote:
> > > The HS/VS interrupt handler needs to access the pipeline object. It
> > > erronously tries to get it from the CCDC output video node, which isn't
> > > necessarily included in the pipeline. This leads to a NULL pointer
> > > dereference.
> > > 
> > > Fix the bug by getting the pipeline object from the CCDC subdev entity.
> > > 
> > > The upstream commit ID is bcf45117d10140852fcdc2bfd36221dc8b996025.
> > 
> > In what tree?  I don't see that id in Linus's tree, are you sure you got
> > it correct?
> > 
> > confused,
> 
> I must have been confused as well :-/
> 
> The upstream commit ID is bd0f2e6da7ea9e225cb2dbd3229e25584b0e9538. Sorry for 
> the mistake.

No problem, now queued up, thanks.

greg k-h

[PATCH - stable v3.2] omap3isp: ccdc: Fix crash in HS/VS interrupt handler

[Laurent Pinchart]

The HS/VS interrupt handler needs to access the pipeline object. It
erronously tries to get it from the CCDC output video node, which isn't
necessarily included in the pipeline. This leads to a NULL pointer
dereference.

Fix the bug by getting the pipeline object from the CCDC subdev entity.

Reported-by: Gary Thomas <gary@mlbassoc.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Acked-by: Sakari Ailus <sakari.ailus@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
---
 drivers/media/video/omap3isp/ispccdc.c |    3 +--
 1 files changed, 1 insertions(+), 2 deletions(-)

The patch fixes a v3.2 bug and has been included in v3.3-rc1. Could you please
add it to the stable v3.2 series ?

diff --git a/drivers/media/video/omap3isp/ispccdc.c b/drivers/media/video/omap3isp/ispccdc.c
index 54a4a3f..a319281 100644
--- a/drivers/media/video/omap3isp/ispccdc.c
+++ b/drivers/media/video/omap3isp/ispccdc.c
@@ -1406,8 +1406,7 @@ static int __ccdc_handle_stopping(struct isp_ccdc_device *ccdc, u32 event)
 
 static void ccdc_hs_vs_isr(struct isp_ccdc_device *ccdc)
 {
-	struct isp_pipeline *pipe =
-		to_isp_pipeline(&ccdc->video_out.video.entity);
+	struct isp_pipeline *pipe = to_isp_pipeline(&ccdc->subdev.entity);
 	struct video_device *vdev = ccdc->subdev.devnode;
 	struct v4l2_event event;
 
-- 
Regards,

Laurent Pinchart

RE: [PATCH - stable v3.2] omap3isp: ccdc: Fix crash in HS/VS interrupt handler

[Nori, Sekhar]

Hi Laurent,

On Sun, Mar 11, 2012 at 17:20:08, Laurent Pinchart wrote:
> The HS/VS interrupt handler needs to access the pipeline object. It
> erronously tries to get it from the CCDC output video node, which isn't
> necessarily included in the pipeline. This leads to a NULL pointer
> dereference.
> 
> Fix the bug by getting the pipeline object from the CCDC subdev entity.
> 
> Reported-by: Gary Thomas <gary@mlbassoc.com>
> Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
> Acked-by: Sakari Ailus <sakari.ailus@iki.fi>
> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
> ---
>  drivers/media/video/omap3isp/ispccdc.c |    3 +--
>  1 files changed, 1 insertions(+), 2 deletions(-)
> 
> The patch fixes a v3.2 bug and has been included in v3.3-rc1. Could you please
> add it to the stable v3.2 series ?

AFAIK, stable@kernel.org is down and the correct address is
stable@vger.kernel.org.

Also, you need to include the upstream commit id in the commit
message (See Documentation/stable_kernel_rules.txt)

Thanks,
Sekhar

Re: [PATCH - stable v3.2] omap3isp: ccdc: Fix crash in HS/VS interrupt handler

[Laurent Pinchart]

Hi Sekhar,

On Sunday 11 March 2012 11:59:12 Nori, Sekhar wrote:
> On Sun, Mar 11, 2012 at 17:20:08, Laurent Pinchart wrote:
> > The HS/VS interrupt handler needs to access the pipeline object. It
> > erronously tries to get it from the CCDC output video node, which isn't
> > necessarily included in the pipeline. This leads to a NULL pointer
> > dereference.
> > 
> > Fix the bug by getting the pipeline object from the CCDC subdev entity.
> > 
> > Reported-by: Gary Thomas <gary@mlbassoc.com>
> > Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
> > Acked-by: Sakari Ailus <sakari.ailus@iki.fi>
> > Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
> > ---
> > 
> >  drivers/media/video/omap3isp/ispccdc.c |    3 +--
> >  1 files changed, 1 insertions(+), 2 deletions(-)
> > 
> > The patch fixes a v3.2 bug and has been included in v3.3-rc1. Could you
> > please add it to the stable v3.2 series ?
> 
> AFAIK, stable@kernel.org is down and the correct address is
> stable@vger.kernel.org.

Oops, my bad.

> Also, you need to include the upstream commit id in the commit
> message (See Documentation/stable_kernel_rules.txt)

I've resent the patch. Thank you.

-- 
Regards,

Laurent Pinchart