Commit 7f404ae9 authored by Mike Isely's avatar Mike Isely Committed by Mauro Carvalho Chehab

media: pvrusb2: Fix oops on tear-down when radio support is not present

In some device configurations there's no radio or radio support in the
driver.  That's OK, as the driver sets itself up accordingly.  However
on tear-down in these caes it's still trying to tear down radio
related context when there isn't anything there, leading to
dereferences through a null pointer and chaos follows.

How this bug survived unfixed for 11 years in the pvrusb2 driver is a
mystery to me.

[hverkuil: fix two checkpatch warnings]
Signed-off-by: default avatarMike Isely <isely@pobox.com>
Signed-off-by: default avatarHans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@kernel.org>
parent 44c77cd9
...@@ -898,8 +898,12 @@ static void pvr2_v4l2_internal_check(struct pvr2_channel *chp) ...@@ -898,8 +898,12 @@ static void pvr2_v4l2_internal_check(struct pvr2_channel *chp)
pvr2_v4l2_dev_disassociate_parent(vp->dev_video); pvr2_v4l2_dev_disassociate_parent(vp->dev_video);
pvr2_v4l2_dev_disassociate_parent(vp->dev_radio); pvr2_v4l2_dev_disassociate_parent(vp->dev_radio);
if (!list_empty(&vp->dev_video->devbase.fh_list) || if (!list_empty(&vp->dev_video->devbase.fh_list) ||
!list_empty(&vp->dev_radio->devbase.fh_list)) (vp->dev_radio &&
!list_empty(&vp->dev_radio->devbase.fh_list))) {
pvr2_trace(PVR2_TRACE_STRUCT,
"pvr2_v4l2 internal_check exit-empty id=%p", vp);
return; return;
}
pvr2_v4l2_destroy_no_lock(vp); pvr2_v4l2_destroy_no_lock(vp);
} }
...@@ -935,7 +939,8 @@ static int pvr2_v4l2_release(struct file *file) ...@@ -935,7 +939,8 @@ static int pvr2_v4l2_release(struct file *file)
kfree(fhp); kfree(fhp);
if (vp->channel.mc_head->disconnect_flag && if (vp->channel.mc_head->disconnect_flag &&
list_empty(&vp->dev_video->devbase.fh_list) && list_empty(&vp->dev_video->devbase.fh_list) &&
list_empty(&vp->dev_radio->devbase.fh_list)) { (!vp->dev_radio ||
list_empty(&vp->dev_radio->devbase.fh_list))) {
pvr2_v4l2_destroy_no_lock(vp); pvr2_v4l2_destroy_no_lock(vp);
} }
return 0; return 0;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment