From patchwork Thu Mar 12 20:24:38 2009 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Michael Ira Krufky X-Patchwork-Id: 852 Return-path: X-OfflineIMAP-x1058262219-426f6d626164696c-494e424f582e6c696e75782d6d65646961: 1241205321-0470882761397-v6.0.3 X-OfflineIMAP-1608691189-4c6f63616c-496e667261646561642e6c696e75782d6d65646961: 1241139609-0678192585811-v6.0.3 Envelope-to: mchehab@infradead.org Delivery-date: Thu, 12 Mar 2009 20:24:44 +0000 Received: from vger.kernel.org ([209.132.176.167]) by bombadil.infradead.org with esmtp (Exim 4.69 #1 (Red Hat Linux)) id 1LhrSO-0004Ct-7f; Thu, 12 Mar 2009 20:24:44 +0000 Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751395AbZCLUYn (ORCPT + 1 other); Thu, 12 Mar 2009 16:24:43 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1751459AbZCLUYn (ORCPT ); Thu, 12 Mar 2009 16:24:43 -0400 Received: from mail-bw0-f178.google.com ([209.85.218.178]:55512 "EHLO mail-bw0-f178.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751395AbZCLUYm convert rfc822-to-8bit (ORCPT ); Thu, 12 Mar 2009 16:24:42 -0400 Received: by bwz26 with SMTP id 26so2008080bwz.37 for ; Thu, 12 Mar 2009 13:24:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:sender:received:in-reply-to :references:date:x-google-sender-auth:message-id:subject:from:to:cc :content-type:content-transfer-encoding; bh=BwGGElt4G5eRqFPFHmtGS1uS9H2VsKskUFTGTfPhqbw=; b=NI8Qltqo3ytWPrWEYQbbiLp2cBLFvuR8lr6B85ce9RR119hoM5CuuNubNjUI/Blgt9 6yNwr+Tn/0+wu3V7MDyGwf1nn4/H1orpN3SOWkpBkqZ5o70InexdEYp56kxw8IRhG+4v 7peXInAudwHQFkMUrnxfM9pO/LL60yw8pBie4= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:sender:in-reply-to:references:date :x-google-sender-auth:message-id:subject:from:to:cc:content-type :content-transfer-encoding; b=Y+ekJ+mP7v2MjMYt2bU9i+FwWJpkKKVC/WYyloPvlNbAtrJMNUJhXgdIhBeX2aTzAt NUPh3NpdhBmAxYhCGTy1oc3I2fcb+cySERhOKu39gnID62JQPxuZWLh5M37+LY8u5i6m wow7SaHd3MlgCWaul+r9pONi9Az9ob6pbzLGI= MIME-Version: 1.0 Received: by 10.86.31.18 with SMTP id e18mr295775fge.72.1236889478721; Thu, 12 Mar 2009 13:24:38 -0700 (PDT) In-Reply-To: <200902241700.56099.jarod@redhat.com> References: <200902241700.56099.jarod@redhat.com> Date: Thu, 12 Mar 2009 16:24:38 -0400 X-Google-Sender-Auth: 4d0f1c18a46f6e79 Message-ID: <37219a840903121324q7b08c8d1ma6d0d3ec4f5eb278@mail.gmail.com> Subject: Fwd: [stable] [PATCH] 2.6.27.y: fix NULL ptr deref in cx23885 video_open From: Michael Krufky To: stable@kernel.org, LKML Cc: Jarod Wilson , LMML Sender: linux-media-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org Can we have this merged into -stable? Jarod Wilson sent this last month, but he left off the cc to stable@kernel.org Signed-off-by: Michael Krufky ---------- Forwarded message ---------- From: Jarod Wilson Date: Tue, Feb 24, 2009 at 6:00 PM Subject: [stable] [PATCH] 2.6.27.y: fix NULL ptr deref in cx23885 video_open To: linux-kernel@vger.kernel.org Cc: Mike Krufky From: Mark Jenks https://www.redhat.com/mailman/private/video4linux-list/2009-January/msg00041.html The Hauppauge WinTV HVR-1800 tv tuner card has both digital and analog abilities, both of which are supported by v4l/dvb under 2.6.27.y. The analog side also features a hardware mpeg2 encoder. The HVR-1250 tv tuner card has both digital and analog abilities, but analog isn't currently supported under any kernel. These cards both utilize the cx23885 driver, but with slightly different usage. When the code paths for each card is executed, they wind up poking a cx23885_devlist, which contains devices from both of the cards, and access attempts are made to portions of 'struct cx23885_dev' that aren't valid for that device. Simply add some extra checks before trying to access these structs. More gory details:  http://article.gmane.org/gmane.linux.drivers.dvb/46630 This was triggering on my own system at home w/both cards in it, and no longer happens with this patch included. Signed-off-by: Jarod Wilson Reviewed-by: Michael Krufky ---  drivers/media/video/cx23885/cx23885-417.c   |    2 +-  drivers/media/video/cx23885/cx23885-video.c |    2 +-  2 files changed, 2 insertions(+), 2 deletions(-)                } -- Jarod Wilson jarod@redhat.com -- To unsubscribe from this list: send the line "unsubscribe linux-media" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/drivers/media/video/cx23885/cx23885-417.c b/drivers/media/video/cx23885/cx23885-417.c index 7b0e8c0..19154b6 100644 --- a/drivers/media/video/cx23885/cx23885-417.c +++ b/drivers/media/video/cx23885/cx23885-417.c @@ -1585,7 +1585,7 @@ static int mpeg_open(struct inode *inode, struct file *file)        list_for_each(list, &cx23885_devlist) {                h = list_entry(list, struct cx23885_dev, devlist); -               if (h->v4l_device->minor == minor) { +               if (h->v4l_device && h->v4l_device->minor == minor) {                        dev = h;                        break;                } diff --git a/drivers/media/video/cx23885/cx23885-video.c b/drivers/media/video/cx23885/cx23885-video.c index 6047c78..a2b5a0c 100644 --- a/drivers/media/video/cx23885/cx23885-video.c +++ b/drivers/media/video/cx23885/cx23885-video.c @@ -733,7 +733,7 @@ static int video_open(struct inode *inode, struct file *file)        list_for_each(list, &cx23885_devlist) {                h = list_entry(list, struct cx23885_dev, devlist); -               if (h->video_dev->minor == minor) { +               if (h->video_dev && h->video_dev->minor == minor) {                        dev  = h;                        type = V4L2_BUF_TYPE_VIDEO_CAPTURE;