From patchwork Tue Jul 27 12:06:07 2010 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Baruch Siach X-Patchwork-Id: 114515 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by demeter.kernel.org (8.14.4/8.14.3) with ESMTP id o6RC6qI9023726 for ; Tue, 27 Jul 2010 12:06:53 GMT Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752706Ab0G0MGv (ORCPT ); Tue, 27 Jul 2010 08:06:51 -0400 Received: from tango.tkos.co.il ([62.219.50.35]:41505 "EHLO tango.tkos.co.il" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750816Ab0G0MGt (ORCPT ); Tue, 27 Jul 2010 08:06:49 -0400 Received: from jasper (89-139-46-109.bb.netvision.net.il [89.139.46.109]) (authenticated bits=0) by tango.tkos.co.il (8.14.4/8.12.11) with ESMTP id o6RC6aEn030070; Tue, 27 Jul 2010 15:06:40 +0300 From: Baruch Siach To: Linux Media Mailing List Cc: Michael Grzeschik , linux-arm-kernel@lists.infradead.org, Sascha Hauer , Baruch Siach Subject: [PATCH 1/4] mx2_camera: fix a race causing NULL dereference Date: Tue, 27 Jul 2010 15:06:07 +0300 Message-Id: <9f12919acb3673ff10249ea3d151eccaa2818859.1280229966.git.baruch@tkos.co.il> X-Mailer: git-send-email 1.7.1 In-Reply-To: References: X-Spam-Level: -2.212 () BAYES_00,RDNS_DYNAMIC X-Scanned-By: MIMEDefang 2.62 on 62.219.50.35 Sender: linux-media-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.2.3 (demeter.kernel.org [140.211.167.41]); Tue, 27 Jul 2010 12:06:53 +0000 (UTC) diff --git a/drivers/media/video/mx2_camera.c b/drivers/media/video/mx2_camera.c index 881d5d8..1536bd4 100644 --- a/drivers/media/video/mx2_camera.c +++ b/drivers/media/video/mx2_camera.c @@ -384,6 +384,9 @@ static void mx25_camera_frame_done(struct mx2_camera_dev *pcdev, int fb, spin_lock_irqsave(&pcdev->lock, flags); + if (*fb_active == NULL) + goto out; + vb = &(*fb_active)->vb; dev_dbg(pcdev->dev, "%s (vb=0x%p) 0x%08lx %d\n", __func__, vb, vb->baddr, vb->bsize); @@ -408,6 +411,7 @@ static void mx25_camera_frame_done(struct mx2_camera_dev *pcdev, int fb, *fb_active = buf; +out: spin_unlock_irqrestore(&pcdev->lock, flags); }