From 07c87a833e9ef92280ed24ab85cd4eb49cbca9c0 Mon Sep 17 00:00:00 2001 From: Andy Walls Date: Mon, 12 May 2008 15:01:27 -0300 Subject: V4L/DVB (7891): cx18/ivtv: fix open() kernel oops Upon error conditions in cx18/ivtv_probe(), the code at the 'err:' label leaves a NULL entry in cx18/ivtv_cards[]. This can cause a NULL pointer de-reference in cx18/ivtv_v4l2_open() which is fixed by this patch. Signed-off-by: Andy Walls Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab --- drivers/media/video/ivtv/ivtv-fileops.c | 2 ++ 1 file changed, 2 insertions(+) (limited to 'drivers/media/video/ivtv/ivtv-fileops.c') diff --git a/drivers/media/video/ivtv/ivtv-fileops.c b/drivers/media/video/ivtv/ivtv-fileops.c index 2b74b0ab1477..f2fa434b677b 100644 --- a/drivers/media/video/ivtv/ivtv-fileops.c +++ b/drivers/media/video/ivtv/ivtv-fileops.c @@ -987,6 +987,8 @@ int ivtv_v4l2_open(struct inode *inode, struct file *filp) /* Find which card this open was on */ spin_lock(&ivtv_cards_lock); for (x = 0; itv == NULL && x < ivtv_cards_active; x++) { + if (ivtv_cards[x] == NULL) + continue; /* find out which stream this open was on */ for (y = 0; y < IVTV_MAX_STREAMS; y++) { s = &ivtv_cards[x]->streams[y]; -- cgit v1.2.3 From b0510f8dc73dce56f35337487c6374ae84b15446 Mon Sep 17 00:00:00 2001 From: Al Viro Date: Wed, 21 May 2008 00:31:41 -0300 Subject: V4L/DVB (7963): ivtv: trivial annotations Signed-off-by: Al Viro Signed-off-by: Mauro Carvalho Chehab --- drivers/media/video/ivtv/ivtv-fileops.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers/media/video/ivtv/ivtv-fileops.c') diff --git a/drivers/media/video/ivtv/ivtv-fileops.c b/drivers/media/video/ivtv/ivtv-fileops.c index f2fa434b677b..db813e071ce6 100644 --- a/drivers/media/video/ivtv/ivtv-fileops.c +++ b/drivers/media/video/ivtv/ivtv-fileops.c @@ -587,7 +587,7 @@ retry: since we may get here before the stream has been fully set-up */ if (mode == OUT_YUV && s->q_full.length == 0 && itv->dma_data_req_size) { while (count >= itv->dma_data_req_size) { - if (!ivtv_yuv_udma_stream_frame (itv, (void *)user_buf)) { + if (!ivtv_yuv_udma_stream_frame (itv, (void __user *)user_buf)) { bytes_written += itv->dma_data_req_size; user_buf += itv->dma_data_req_size; count -= itv->dma_data_req_size; -- cgit v1.2.3