Skip to contentSkip to conversation

potential null deref in mpeg_open()

DISCUSSION Dan Carpenter 2 participants 2 messages Jul 19, 2009 – Jul 20, 2009 Media (V4L/DVB)

lore
Share & tools
lore
#0 lore raw

Hello,

I am testing a source checker (http://repo.or.cz/w/smatch.git) and it found a bug in in mpeg_open() from drivers/media/video/cx23885/cx23885-417.c

"dev" is null on line 1554, so on line 1558 dprintk() will cause a kernel oops if it is in debug mode.

drivers/media/video/cx23885/cx23885-417.c

  1554          struct cx23885_dev *h, *dev = NULL;
  1555          struct list_head *list;
  1556          struct cx23885_fh *fh;

1557
1558 dprintk(2, "%s()\n", __func__);

Here is how dprintk() is defined earlier.

drivers/media/video/cx23885/cx23885-417.c

    59  #define dprintk(level, fmt, arg...)\
    60          do { if (v4l_debug >= level) \
    61                  printk(KERN_DEBUG "%s: " fmt, dev->name , ## arg);\
    62          } while (0)

regards,
dan carpenter

#1 lore raw
Quoted 17 lines · Dan Carpenter

Hello,

I am testing a source checker (http://repo.or.cz/w/smatch.git) and it found a bug in in mpeg_open() from drivers/media/video/cx23885/cx23885-417.c

"dev" is null on line 1554, so on line 1558 dprintk() will cause a kernel oops if it is in debug mode.

drivers/media/video/cx23885/cx23885-417.c

   1554          struct cx23885_dev *h, *dev = NULL;
   1555          struct list_head *list;
   1556          struct cx23885_fh *fh;

1557
1558 dprintk(2, "%s()\n", __func__);

Here is how dprintk() is defined earlier.

Quoted 8 lines

drivers/media/video/cx23885/cx23885-417.c

     59  #define dprintk(level, fmt, arg...)\
     60          do { if (v4l_debug>= level) \
     61                  printk(KERN_DEBUG "%s: " fmt, dev->name , ## arg);\
     62          } while (0)

regards,
dan carpenter

Thanks Dan,

I'd actually seen this three weeks ago when addressing another issue, although thanks for raising it. We're pushing a fix for this, and a few other fixes, later today.

Signature · 2 lines
Steven Toth - Kernel Labs
http://www.kernellabs.com