| From foo@baz Mon Apr 9 17:09:24 CEST 2018 |
| From: Pan Bian <bianpan2016@163.com> |
| Date: Sun, 23 Apr 2017 10:06:36 -0300 |
| Subject: [media] cx25840: fix unchecked return values |
| |
| From: Pan Bian <bianpan2016@163.com> |
| |
| |
| [ Upstream commit 35378ce143071c2a6bad4b59a000e9b9f8f6ea67 ] |
| |
| In functions cx25840_initialize(), cx231xx_initialize(), and |
| cx23885_initialize(), the return value of create_singlethread_workqueue() |
| is used without validation. This may result in NULL dereference and cause |
| kernel crash. This patch fixes it. |
| |
| Signed-off-by: Pan Bian <bianpan2016@163.com> |
| Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> |
| Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com> |
| Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| drivers/media/i2c/cx25840/cx25840-core.c | 36 ++++++++++++++++++------------- |
| 1 file changed, 21 insertions(+), 15 deletions(-) |
| |
| --- a/drivers/media/i2c/cx25840/cx25840-core.c |
| +++ b/drivers/media/i2c/cx25840/cx25840-core.c |
| @@ -420,11 +420,13 @@ static void cx25840_initialize(struct i2 |
| INIT_WORK(&state->fw_work, cx25840_work_handler); |
| init_waitqueue_head(&state->fw_wait); |
| q = create_singlethread_workqueue("cx25840_fw"); |
| - prepare_to_wait(&state->fw_wait, &wait, TASK_UNINTERRUPTIBLE); |
| - queue_work(q, &state->fw_work); |
| - schedule(); |
| - finish_wait(&state->fw_wait, &wait); |
| - destroy_workqueue(q); |
| + if (q) { |
| + prepare_to_wait(&state->fw_wait, &wait, TASK_UNINTERRUPTIBLE); |
| + queue_work(q, &state->fw_work); |
| + schedule(); |
| + finish_wait(&state->fw_wait, &wait); |
| + destroy_workqueue(q); |
| + } |
| |
| /* 6. */ |
| cx25840_write(client, 0x115, 0x8c); |
| @@ -634,11 +636,13 @@ static void cx23885_initialize(struct i2 |
| INIT_WORK(&state->fw_work, cx25840_work_handler); |
| init_waitqueue_head(&state->fw_wait); |
| q = create_singlethread_workqueue("cx25840_fw"); |
| - prepare_to_wait(&state->fw_wait, &wait, TASK_UNINTERRUPTIBLE); |
| - queue_work(q, &state->fw_work); |
| - schedule(); |
| - finish_wait(&state->fw_wait, &wait); |
| - destroy_workqueue(q); |
| + if (q) { |
| + prepare_to_wait(&state->fw_wait, &wait, TASK_UNINTERRUPTIBLE); |
| + queue_work(q, &state->fw_work); |
| + schedule(); |
| + finish_wait(&state->fw_wait, &wait); |
| + destroy_workqueue(q); |
| + } |
| |
| /* Call the cx23888 specific std setup func, we no longer rely on |
| * the generic cx24840 func. |
| @@ -752,11 +756,13 @@ static void cx231xx_initialize(struct i2 |
| INIT_WORK(&state->fw_work, cx25840_work_handler); |
| init_waitqueue_head(&state->fw_wait); |
| q = create_singlethread_workqueue("cx25840_fw"); |
| - prepare_to_wait(&state->fw_wait, &wait, TASK_UNINTERRUPTIBLE); |
| - queue_work(q, &state->fw_work); |
| - schedule(); |
| - finish_wait(&state->fw_wait, &wait); |
| - destroy_workqueue(q); |
| + if (q) { |
| + prepare_to_wait(&state->fw_wait, &wait, TASK_UNINTERRUPTIBLE); |
| + queue_work(q, &state->fw_work); |
| + schedule(); |
| + finish_wait(&state->fw_wait, &wait); |
| + destroy_workqueue(q); |
| + } |
| |
| cx25840_std_setup(client); |
| |