From: Andy Walls <awalls@radix.net>
Date: Mon, 12 May 2008 18:01:27 +0000 (-0300)
Subject: V4L/DVB (7891): cx18/ivtv: fix open() kernel oops
X-Git-Tag: v2.6.26-rc3~62^2~5
X-Git-Url: http://pilppa.com/gitweb/?a=commitdiff_plain;h=07c87a833e9ef92280ed24ab85cd4eb49cbca9c0;p=linux-2.6-omap-h63xx.git

V4L/DVB (7891): cx18/ivtv: fix open() kernel oops

Upon error conditions in cx18/ivtv_probe(), the code at the 'err:' label
leaves a NULL entry in cx18/ivtv_cards[]. This can cause a NULL pointer
de-reference in cx18/ivtv_v4l2_open() which is fixed by this patch.

Signed-off-by: Andy Walls <awalls@radix.net>
Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
---

diff --git a/drivers/media/video/cx18/cx18-fileops.c b/drivers/media/video/cx18/cx18-fileops.c
index 91eff6e671a..0b3141db174 100644
--- a/drivers/media/video/cx18/cx18-fileops.c
+++ b/drivers/media/video/cx18/cx18-fileops.c
@@ -662,6 +662,8 @@ int cx18_v4l2_open(struct inode *inode, struct file *filp)
 	for (x = 0; cx == NULL && x < cx18_cards_active; x++) {
 		/* find out which stream this open was on */
 		for (y = 0; y < CX18_MAX_STREAMS; y++) {
+			if (cx18_cards[x] == NULL)
+				continue;
 			s = &cx18_cards[x]->streams[y];
 			if (s->v4l2dev && s->v4l2dev->minor == minor) {
 				cx = cx18_cards[x];
diff --git a/drivers/media/video/ivtv/ivtv-fileops.c b/drivers/media/video/ivtv/ivtv-fileops.c
index 2b74b0ab147..f2fa434b677 100644
--- a/drivers/media/video/ivtv/ivtv-fileops.c
+++ b/drivers/media/video/ivtv/ivtv-fileops.c
@@ -987,6 +987,8 @@ int ivtv_v4l2_open(struct inode *inode, struct file *filp)
 	/* Find which card this open was on */
 	spin_lock(&ivtv_cards_lock);
 	for (x = 0; itv == NULL && x < ivtv_cards_active; x++) {
+		if (ivtv_cards[x] == NULL)
+			continue;
 		/* find out which stream this open was on */
 		for (y = 0; y < IVTV_MAX_STREAMS; y++) {
 			s = &ivtv_cards[x]->streams[y];