potential null deref in mpeg_open()
Hello,
I am testing a source checker (http://repo.or.cz/w/smatch.git) and it found a bug in in mpeg_open() from drivers/media/video/cx23885/cx23885-417.c
"dev" is null on line 1554, so on line 1558 dprintk() will cause a kernel oops if it is in debug mode.
drivers/media/video/cx23885/cx23885-417.c
1554 struct cx23885_dev *h, *dev = NULL; 1555 struct list_head *list; 1556 struct cx23885_fh *fh;
1557
1558 dprintk(2, "%s()\n", __func__);
Here is how dprintk() is defined earlier.
drivers/media/video/cx23885/cx23885-417.c
59 #define dprintk(level, fmt, arg...)\
60 do { if (v4l_debug >= level) \
61 printk(KERN_DEBUG "%s: " fmt, dev->name , ## arg);\
62 } while (0)regards,
dan carpenter
Quoted 17 lines · Dan Carpenter
Hello,
I am testing a source checker (http://repo.or.cz/w/smatch.git) and it found a bug in in
mpeg_open()fromdrivers/media/video/cx23885/cx23885-417.c"dev" is null on line 1554, so on line 1558
dprintk()will cause a kernel oops if it is in debug mode.
drivers/media/video/cx23885/cx23885-417.c1554 struct cx23885_dev *h, *dev = NULL; 1555 struct list_head *list; 1556 struct cx23885_fh *fh;1557
1558dprintk(2, "%s()\n", __func__);Here is how
dprintk()is defined earlier.
Quoted 8 lines
drivers/media/video/cx23885/cx23885-417.c59 #define dprintk(level, fmt, arg...)\ 60 do { if (v4l_debug>= level) \ 61 printk(KERN_DEBUG "%s: " fmt, dev->name , ## arg);\ 62 } while (0)regards,
dan carpenter
Thanks Dan,
I'd actually seen this three weeks ago when addressing another issue, although thanks for raising it. We're pushing a fix for this, and a few other fixes, later today.
Signature · 2 lines
Steven Toth - Kernel Labs http://www.kernellabs.com