Commit e34d375a authored by Jiri Slaby's avatar Jiri Slaby Committed by Mauro Carvalho Chehab

V4L/DVB (13968): cx18, fix potential null dereference

Stanse found a potential null dereference in cx18_dvb_start_feed
and cx18_dvb_stop_feed. There is a check for stream being NULL,
but it is dereferenced earlier. Move the dereference after the
check.
Signed-off-by: default avatarJiri Slaby <jslaby@suse.cz>
Reviewed-by: default avatarAndy Walls <awalls@radix.net>
Acked-by: default avatarAndy Walls <awalls@radix.net>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@redhat.com>
parent 8231152f
...@@ -213,10 +213,14 @@ static int cx18_dvb_start_feed(struct dvb_demux_feed *feed) ...@@ -213,10 +213,14 @@ static int cx18_dvb_start_feed(struct dvb_demux_feed *feed)
{ {
struct dvb_demux *demux = feed->demux; struct dvb_demux *demux = feed->demux;
struct cx18_stream *stream = (struct cx18_stream *) demux->priv; struct cx18_stream *stream = (struct cx18_stream *) demux->priv;
struct cx18 *cx = stream->cx; struct cx18 *cx;
int ret; int ret;
u32 v; u32 v;
if (!stream)
return -EINVAL;
cx = stream->cx;
CX18_DEBUG_INFO("Start feed: pid = 0x%x index = %d\n", CX18_DEBUG_INFO("Start feed: pid = 0x%x index = %d\n",
feed->pid, feed->index); feed->pid, feed->index);
...@@ -253,9 +257,6 @@ static int cx18_dvb_start_feed(struct dvb_demux_feed *feed) ...@@ -253,9 +257,6 @@ static int cx18_dvb_start_feed(struct dvb_demux_feed *feed)
if (!demux->dmx.frontend) if (!demux->dmx.frontend)
return -EINVAL; return -EINVAL;
if (!stream)
return -EINVAL;
mutex_lock(&stream->dvb.feedlock); mutex_lock(&stream->dvb.feedlock);
if (stream->dvb.feeding++ == 0) { if (stream->dvb.feeding++ == 0) {
CX18_DEBUG_INFO("Starting Transport DMA\n"); CX18_DEBUG_INFO("Starting Transport DMA\n");
...@@ -279,13 +280,14 @@ static int cx18_dvb_stop_feed(struct dvb_demux_feed *feed) ...@@ -279,13 +280,14 @@ static int cx18_dvb_stop_feed(struct dvb_demux_feed *feed)
{ {
struct dvb_demux *demux = feed->demux; struct dvb_demux *demux = feed->demux;
struct cx18_stream *stream = (struct cx18_stream *)demux->priv; struct cx18_stream *stream = (struct cx18_stream *)demux->priv;
struct cx18 *cx = stream->cx; struct cx18 *cx;
int ret = -EINVAL; int ret = -EINVAL;
CX18_DEBUG_INFO("Stop feed: pid = 0x%x index = %d\n",
feed->pid, feed->index);
if (stream) { if (stream) {
cx = stream->cx;
CX18_DEBUG_INFO("Stop feed: pid = 0x%x index = %d\n",
feed->pid, feed->index);
mutex_lock(&stream->dvb.feedlock); mutex_lock(&stream->dvb.feedlock);
if (--stream->dvb.feeding == 0) { if (--stream->dvb.feeding == 0) {
CX18_DEBUG_INFO("Stopping Transport DMA\n"); CX18_DEBUG_INFO("Stopping Transport DMA\n");
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment