* [PATCH] media: mxl111sf: fix null pointer dereference in mxl111sf_ctrl_msg
@ 2026-05-13 23:55 Moksh Panicker
0 siblings, 0 replies; 3+ messages in thread
From: Moksh Panicker @ 2026-05-13 23:55 UTC (permalink / raw)
To: linux-media; +Cc: Moksh Panicker, stable
When mxl111sf_ctrl_msg() is called during early probe, state->d
may not yet be initialized, causing a null pointer dereference in
dvb_usbv2_generic_write() when it accesses d->usb_mutex.
Add a null check for d before proceeding with the USB transfer.
Fixes: d90b336f3f65 ("[media] mxl111sf: Fix driver to use heap allocate buffers for USB messages")
Cc: stable@vger.kernel.org
Signed-off-by: Moksh Panicker <mokshpanicker.7@gmail.com>
---
drivers/media/usb/dvb-usb-v2/mxl111sf.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/media/usb/dvb-usb-v2/mxl111sf.c b/drivers/media/usb/dvb-usb-v2/mxl111sf.c
index 870ac3c8b085..9908675c355e 100644
--- a/drivers/media/usb/dvb-usb-v2/mxl111sf.c
+++ b/drivers/media/usb/dvb-usb-v2/mxl111sf.c
@@ -56,6 +56,9 @@ int mxl111sf_ctrl_msg(struct mxl111sf_state *state,
int wo = (rbuf == NULL || rlen == 0); /* write-only */
int ret;
+ if (!d)
+ return -ENODEV;
+
if (1 + wlen > MXL_MAX_XFER_SIZE) {
pr_warn("%s: len=%d is too big!\n", __func__, wlen);
return -EOPNOTSUPP;
--
2.34.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* [PATCH] media: mxl111sf: fix null pointer dereference in mxl111sf_ctrl_msg
@ 2026-05-13 23:57 Moksh Panicker
0 siblings, 0 replies; 3+ messages in thread
From: Moksh Panicker @ 2026-05-13 23:57 UTC (permalink / raw)
To: linux-media; +Cc: Moksh Panicker, stable
When mxl111sf_ctrl_msg() is called during early probe, state->d
may not yet be initialized, causing a null pointer dereference in
dvb_usbv2_generic_write() when it accesses d->usb_mutex.
Add a null check for d before proceeding with the USB transfer.
Fixes: d90b336f3f65 ("[media] mxl111sf: Fix driver to use heap allocate buffers for USB messages")
Cc: stable@vger.kernel.org
Signed-off-by: Moksh Panicker <mokshpanicker.7@gmail.com>
---
drivers/media/usb/dvb-usb-v2/mxl111sf.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/media/usb/dvb-usb-v2/mxl111sf.c b/drivers/media/usb/dvb-usb-v2/mxl111sf.c
index 870ac3c8b085..9908675c355e 100644
--- a/drivers/media/usb/dvb-usb-v2/mxl111sf.c
+++ b/drivers/media/usb/dvb-usb-v2/mxl111sf.c
@@ -56,6 +56,9 @@ int mxl111sf_ctrl_msg(struct mxl111sf_state *state,
int wo = (rbuf == NULL || rlen == 0); /* write-only */
int ret;
+ if (!d)
+ return -ENODEV;
+
if (1 + wlen > MXL_MAX_XFER_SIZE) {
pr_warn("%s: len=%d is too big!\n", __func__, wlen);
return -EOPNOTSUPP;
--
2.34.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* [PATCH] media: mxl111sf: fix null pointer dereference in mxl111sf_ctrl_msg
@ 2026-05-14 0:01 Moksh Panicker
0 siblings, 0 replies; 3+ messages in thread
From: Moksh Panicker @ 2026-05-14 0:01 UTC (permalink / raw)
To: linux-media; +Cc: Moksh Panicker, stable
When mxl111sf_ctrl_msg() is called during early probe, state->d
may not yet be initialized, causing a null pointer dereference in
dvb_usbv2_generic_write() when it accesses d->usb_mutex.
Add a null check for d before proceeding with the USB transfer.
Fixes: d90b336f3f65 ("[media] mxl111sf: Fix driver to use heap allocate buffers for USB messages")
Cc: stable@vger.kernel.org
Signed-off-by: Moksh Panicker <mokshpanicker.7@gmail.com>
---
drivers/media/usb/dvb-usb-v2/mxl111sf.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/media/usb/dvb-usb-v2/mxl111sf.c b/drivers/media/usb/dvb-usb-v2/mxl111sf.c
index 870ac3c8b085..9908675c355e 100644
--- a/drivers/media/usb/dvb-usb-v2/mxl111sf.c
+++ b/drivers/media/usb/dvb-usb-v2/mxl111sf.c
@@ -56,6 +56,9 @@ int mxl111sf_ctrl_msg(struct mxl111sf_state *state,
int wo = (rbuf == NULL || rlen == 0); /* write-only */
int ret;
+ if (!d)
+ return -ENODEV;
+
if (1 + wlen > MXL_MAX_XFER_SIZE) {
pr_warn("%s: len=%d is too big!\n", __func__, wlen);
return -EOPNOTSUPP;
--
2.34.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-05-14 0:01 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-05-13 23:55 [PATCH] media: mxl111sf: fix null pointer dereference in mxl111sf_ctrl_msg Moksh Panicker
-- strict thread matches above, loose matches on Subject: below --
2026-05-13 23:57 Moksh Panicker
2026-05-14 0:01 Moksh Panicker
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox