* [patch] Re: V4L bug report - oops: video_register_device (ksymoops, objdump)
[not found] <40983350.4020403@web.de>
@ 2004-05-05 7:50 ` Gerd Knorr
0 siblings, 0 replies; only message in thread
From: Gerd Knorr @ 2004-05-05 7:50 UTC (permalink / raw)
To: Linus Torvalds, Marcelo Tosatti, Kernel List, degerrit
On Wed, May 05, 2004 at 02:20:32AM +0200, degerrit@web.de wrote:
> I caused an oops in unusual circumstances by accidentally "forcing" a
> video device number which was too high or already taken (don't know
> which). I assume this probably shouldn't give an oops (though it was my
> fault), so here's a bugreport...
Fixed by adding a range check for the number passed in by the driver.
The fix applies to 2.4 kernels as well.
Gerd
--- linux-2.6.6-rc2/drivers/media/video/videodev.c~ 2004-04-21 15:05:10.000000000 +0200
+++ linux-2.6.6-rc2/drivers/media/video/videodev.c 2004-05-05 09:38:20.032625621 +0200
@@ -316,7 +316,14 @@
/* pick a minor number */
down(&videodev_lock);
- if (-1 == nr) {
+ if (nr >= 0 && nr < end-base) {
+ /* use the one the driver asked for */
+ i = base+nr;
+ if (NULL != video_device[i]) {
+ up(&videodev_lock);
+ return -ENFILE;
+ }
+ } else {
/* use first free */
for(i=base;i<end;i++)
if (NULL == video_device[i])
@@ -325,13 +332,6 @@
up(&videodev_lock);
return -ENFILE;
}
- } else {
- /* use the one the driver asked for */
- i = base+nr;
- if (NULL != video_device[i]) {
- up(&videodev_lock);
- return -ENFILE;
- }
}
video_device[i]=vfd;
vfd->minor=i;
^ permalink raw reply [flat|nested] only message in thread