Re: Fwd: [stable] [PATCH] 2.6.27.y: fix NULL ptr deref in cx23885 video_open

[Andy Walls <awalls@radix.net>]

On Thu, 2009-03-12 at 16:24 -0400, Michael Krufky wrote:
> Can we have this merged into -stable?  Jarod Wilson sent this last
> month, but he left off the cc to stable@kernel.org
> 
> Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>

Mike,

A version of this is already in the v4l-dvb hg development repository:

hg log -vp --limit 1 linux/drivers/media/video/cx23885/cx23885-417.c
hg log -vp --limit 2 linux/drivers/media/video/cx23885/cx23885-video.c 

I helped Mark work through the solution: I coded some of it, he coded
some of it and he also tested it.

Regards,
Andy


> 
> ---------- Forwarded message ----------
> From: Jarod Wilson <jarod@redhat.com>
> Date: Tue, Feb 24, 2009 at 6:00 PM
> Subject: [stable] [PATCH] 2.6.27.y: fix NULL ptr deref in cx23885 video_open
> To: linux-kernel@vger.kernel.org
> Cc: Mike Krufky <mkrufky@linuxtv.org>
> 
> 
> From: Mark Jenks
> https://www.redhat.com/mailman/private/video4linux-list/2009-January/msg00041.html
> 
> The Hauppauge WinTV HVR-1800 tv tuner card has both digital and analog
> abilities, both of which are supported by v4l/dvb under 2.6.27.y. The analog
> side also features a hardware mpeg2 encoder. The HVR-1250 tv tuner card
> has both digital and analog abilities, but analog isn't currently supported
> under any kernel. These cards both utilize the cx23885 driver, but with
> slightly different usage. When the code paths for each card is executed,
> they wind up poking a cx23885_devlist, which contains devices from both
> of the cards, and access attempts are made to portions of 'struct
> cx23885_dev' that aren't valid for that device. Simply add some extra
> checks before trying to access these structs.
> 
> More gory details:
>  http://article.gmane.org/gmane.linux.drivers.dvb/46630
> 
> This was triggering on my own system at home w/both cards in it, and
> no longer happens with this patch included.
> 
> Signed-off-by: Jarod Wilson <jarod@redhat.com>
> Reviewed-by: Michael Krufky <mkrufky@linuxtv.org>
> 
> ---
> 
>  drivers/media/video/cx23885/cx23885-417.c   |    2 +-
>  drivers/media/video/cx23885/cx23885-video.c |    2 +-
>  2 files changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/media/video/cx23885/cx23885-417.c
> b/drivers/media/video/cx23885/cx23885-417.c
> index 7b0e8c0..19154b6 100644
> --- a/drivers/media/video/cx23885/cx23885-417.c
> +++ b/drivers/media/video/cx23885/cx23885-417.c
> @@ -1585,7 +1585,7 @@ static int mpeg_open(struct inode *inode, struct
> file *file)
> 
>        list_for_each(list, &cx23885_devlist) {
>                h = list_entry(list, struct cx23885_dev, devlist);
> -               if (h->v4l_device->minor == minor) {
> +               if (h->v4l_device && h->v4l_device->minor == minor) {
>                        dev = h;
>                        break;
>                }
> diff --git a/drivers/media/video/cx23885/cx23885-video.c
> b/drivers/media/video/cx23885/cx23885-video.c
> index 6047c78..a2b5a0c 100644
> --- a/drivers/media/video/cx23885/cx23885-video.c
> +++ b/drivers/media/video/cx23885/cx23885-video.c
> @@ -733,7 +733,7 @@ static int video_open(struct inode *inode, struct
> file *file)
> 
>        list_for_each(list, &cx23885_devlist) {
>                h = list_entry(list, struct cx23885_dev, devlist);
> -               if (h->video_dev->minor == minor) {
> +               if (h->video_dev && h->video_dev->minor == minor) {
>                        dev  = h;
>                        type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
>                }
> 
> 
> --
> Jarod Wilson
> jarod@redhat.com
> --
> To unsubscribe from this list: send the line "unsubscribe linux-media" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
>