diff options
| author | Guennadi Liakhovetski <g.liakhovetski@gmx.de> | 2011-07-04 12:15:14 -0300 |
|---|---|---|
| committer | Mauro Carvalho Chehab <mchehab@redhat.com> | 2011-07-27 17:56:09 -0300 |
| commit | cb74cf5349a6a9225bbab278a808d5a0739c3b2c (patch) | |
| tree | f666bd328e9f8cdfd47ebb71e2427d7ecd3b8137 /drivers/media | |
| parent | 7dfff95366f48bf66f77c17cdc9ebd8be696ac5d (diff) | |
| download | lwn-cb74cf5349a6a9225bbab278a808d5a0739c3b2c.tar.gz lwn-cb74cf5349a6a9225bbab278a808d5a0739c3b2c.zip | |
[media] V4L: sh_mobile_ceu_camera: fix Oops when USERPTR mapping fails
If vb2_dma_contig_get_userptr() fails on a videobuffer, driver's
.buf_init() method will not be called and the list will not be
initialised. Trying to remove an uninitialised element from a list leads
to a NULL-dereference.
Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
Tested-by: Bastian Hecht <hechtb@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Diffstat (limited to 'drivers/media')
| -rw-r--r-- | drivers/media/video/sh_mobile_ceu_camera.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/drivers/media/video/sh_mobile_ceu_camera.c b/drivers/media/video/sh_mobile_ceu_camera.c index f86550703f8e..e54089802b6b 100644 --- a/drivers/media/video/sh_mobile_ceu_camera.c +++ b/drivers/media/video/sh_mobile_ceu_camera.c @@ -422,8 +422,12 @@ static void sh_mobile_ceu_videobuf_release(struct vb2_buffer *vb) pcdev->active = NULL; } - /* Doesn't hurt also if the list is empty */ - list_del_init(&buf->queue); + /* + * Doesn't hurt also if the list is empty, but it hurts, if queuing the + * buffer failed, and .buf_init() hasn't been called + */ + if (buf->queue.next) + list_del_init(&buf->queue); spin_unlock_irq(&pcdev->lock); } |