From: Mauro Carvalho Chehab Date: Mon, 1 Feb 2010 13:35:22 +0000 (-0300) Subject: V4L/DVB: Fix the risk of an oops at dvb_dmx_release X-Git-Tag: v2.6.33-rc8~40^2~2 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=adefdceef4c1cefee2678724cd57824c8ca80091;p=platform%2Fupstream%2Fkernel-adaptation-pc.git V4L/DVB: Fix the risk of an oops at dvb_dmx_release dvb_dmx_init tries to allocate virtual memory for 2 pointers: filter and feed. If the second vmalloc fails, filter is freed, but the pointer keeps pointing to the old place. Later, when dvb_dmx_release() is called, it will try to free an already freed memory, causing an OOPS. Reviewed-by: Andy Walls Signed-off-by: Mauro Carvalho Chehab --- diff --git a/drivers/media/dvb/dvb-core/dvb_demux.c b/drivers/media/dvb/dvb-core/dvb_demux.c index b78cfb7..a78408e 100644 --- a/drivers/media/dvb/dvb-core/dvb_demux.c +++ b/drivers/media/dvb/dvb-core/dvb_demux.c @@ -1246,6 +1246,7 @@ int dvb_dmx_init(struct dvb_demux *dvbdemux) dvbdemux->feed = vmalloc(dvbdemux->feednum * sizeof(struct dvb_demux_feed)); if (!dvbdemux->feed) { vfree(dvbdemux->filter); + dvbdemux->filter = NULL; return -ENOMEM; } for (i = 0; i < dvbdemux->filternum; i++) {