From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-eopbgr710107.outbound.protection.outlook.com ([40.107.71.107]:21288 "EHLO NAM05-BY2-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1727650AbeIGFOR (ORCPT ); Fri, 7 Sep 2018 01:14:17 -0400 From: Sasha Levin To: "stable@vger.kernel.org" , "linux-kernel@vger.kernel.org" CC: Krzysztof Ha?asa , Hans Verkuil , Mauro Carvalho Chehab , Sasha Levin Subject: [PATCH AUTOSEL 4.18 24/88] media: tw686x: Fix oops on buffer alloc failure Date: Fri, 7 Sep 2018 00:36:09 +0000 Message-ID: <20180907003547.57567-24-alexander.levin@microsoft.com> References: <20180907003547.57567-1-alexander.levin@microsoft.com> In-Reply-To: <20180907003547.57567-1-alexander.levin@microsoft.com> Content-Language: en-US Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org List-ID: From: Krzysztof Ha?asa [ Upstream commit 5a1a2f63d840dc2631505b607e11ff65ac1b7d3c ] The error path currently calls tw686x_video_free() which requires vc->dev to be initialized, causing a NULL dereference on uninitizalized channels. Fix this by setting the vc->dev fields for all the channels first. Fixes: f8afaa8dbc0d ("[media] tw686x: Introduce an interface to support mul= tiple DMA modes") Signed-off-by: Krzysztof Ha?asa Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin --- drivers/media/pci/tw686x/tw686x-video.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/drivers/media/pci/tw686x/tw686x-video.c b/drivers/media/pci/tw= 686x/tw686x-video.c index 0ea8dd44026c..3a06c000f97b 100644 --- a/drivers/media/pci/tw686x/tw686x-video.c +++ b/drivers/media/pci/tw686x/tw686x-video.c @@ -1190,6 +1190,14 @@ int tw686x_video_init(struct tw686x_dev *dev) return err; } =20 + /* Initialize vc->dev and vc->ch for the error path */ + for (ch =3D 0; ch < max_channels(dev); ch++) { + struct tw686x_video_channel *vc =3D &dev->video_channels[ch]; + + vc->dev =3D dev; + vc->ch =3D ch; + } + for (ch =3D 0; ch < max_channels(dev); ch++) { struct tw686x_video_channel *vc =3D &dev->video_channels[ch]; struct video_device *vdev; @@ -1198,9 +1206,6 @@ int tw686x_video_init(struct tw686x_dev *dev) spin_lock_init(&vc->qlock); INIT_LIST_HEAD(&vc->vidq_queued); =20 - vc->dev =3D dev; - vc->ch =3D ch; - /* default settings */ err =3D tw686x_set_standard(vc, V4L2_STD_NTSC); if (err) --=20 2.17.1