Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

V4L/DVB: dvb-core: fix initialization of feeds list in demux filter

A DVB demultiplexer device can be used to set up either a PES filter or
a section filter. In the former case, the ts field of the feed union of
struct dmxdev_filter is used, in the latter case the sec field of the
same union is used.
The ts field is a struct list_head, and is currently initialized in the
open() method of the demux device. When for a given demuxer a section
filter is set up, the sec field is played with, thus if a PES filter
needs to be set up after that the ts field will be corrupted, causing a
kernel oops.
This fix moves the list head initialization to
dvb_dmxdev_pes_filter_set(), so that the ts field is properly
initialized every time a PES filter is set up.

Signed-off-by: Francesco Lavra <francescolavra@interfree.it>
Cc: stable <stable@kernel.org>
Reviewed-by: Andy Walls <awalls@radix.net>
Tested-by: hermann pitton <hermann-pitton@arcor.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

authored by

Francesco Lavra and committed by
Mauro Carvalho Chehab
691c9ae0 bc081cc8

+1 -1
+1 -1
drivers/media/dvb/dvb-core/dmxdev.c
··· 761 761 dvb_ringbuffer_init(&dmxdevfilter->buffer, NULL, 8192); 762 762 dmxdevfilter->type = DMXDEV_TYPE_NONE; 763 763 dvb_dmxdev_filter_state_set(dmxdevfilter, DMXDEV_STATE_ALLOCATED); 764 - INIT_LIST_HEAD(&dmxdevfilter->feed.ts); 765 764 init_timer(&dmxdevfilter->timer); 766 765 767 766 dvbdev->users++; ··· 886 887 dmxdevfilter->type = DMXDEV_TYPE_PES; 887 888 memcpy(&dmxdevfilter->params, params, 888 889 sizeof(struct dmx_pes_filter_params)); 890 + INIT_LIST_HEAD(&dmxdevfilter->feed.ts); 889 891 890 892 dvb_dmxdev_filter_state_set(dmxdevfilter, DMXDEV_STATE_SET); 891 893