Re: potential null deref in mpeg_open()

[Steven Toth <stoth@kernellabs.com>]

On 7/19/09 7:47 AM, Dan Carpenter wrote:
> Hello,
>
> I am testing a source checker (http://repo.or.cz/w/smatch.git) and it
> found a bug in in mpeg_open() from drivers/media/video/cx23885/cx23885-417.c
>
> "dev" is null on line 1554, so on line 1558 dprintk() will cause a
> kernel oops if it is in debug mode.
>
> drivers/media/video/cx23885/cx23885-417.c
>    1554          struct cx23885_dev *h, *dev = NULL;
>    1555          struct list_head *list;
>    1556          struct cx23885_fh *fh;
>    1557
>    1558          dprintk(2, "%s()\n", __func__);
>
> Here is how dprintk() is defined earlier.
>
> drivers/media/video/cx23885/cx23885-417.c
>      59  #define dprintk(level, fmt, arg...)\
>      60          do { if (v4l_debug>= level) \
>      61                  printk(KERN_DEBUG "%s: " fmt, dev->name , ## arg);\
>      62          } while (0)
>
> regards,
> dan carpenter

Thanks Dan,

I'd actually seen this three weeks ago when addressing another issue, although 
thanks for raising it. We're pushing a fix for this, and a few other fixes, 
later today.

-- 
Steven Toth - Kernel Labs
http://www.kernellabs.com