From: Mauro Carvalho Chehab Date: Mon, 1 Feb 2010 13:35:22 +0000 (-0300) Subject: V4L/DVB: Fix the risk of an oops at dvb_dmx_release X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=adefdceef4c1cefee2678724cd57824c8ca80091;p=GitHub%2Fexynos8895%2Fandroid_kernel_samsung_universal8895.git V4L/DVB: Fix the risk of an oops at dvb_dmx_release dvb_dmx_init tries to allocate virtual memory for 2 pointers: filter and feed. If the second vmalloc fails, filter is freed, but the pointer keeps pointing to the old place. Later, when dvb_dmx_release() is called, it will try to free an already freed memory, causing an OOPS. Reviewed-by: Andy Walls Signed-off-by: Mauro Carvalho Chehab --- diff --git a/drivers/media/dvb/dvb-core/dvb_demux.c b/drivers/media/dvb/dvb-core/dvb_demux.c index b78cfb7d1897..a78408e76e75 100644 --- a/drivers/media/dvb/dvb-core/dvb_demux.c +++ b/drivers/media/dvb/dvb-core/dvb_demux.c @@ -1246,6 +1246,7 @@ int dvb_dmx_init(struct dvb_demux *dvbdemux) dvbdemux->feed = vmalloc(dvbdemux->feednum * sizeof(struct dvb_demux_feed)); if (!dvbdemux->feed) { vfree(dvbdemux->filter); + dvbdemux->filter = NULL; return -ENOMEM; } for (i = 0; i < dvbdemux->filternum; i++) {