dev->free_buff_list and dev->rec_buff_list are zero initialized after
kzalloc of dev. If something goes wrong before INIT_LIST_HEAD for them,
goto error leads to call hdpvr_delete() and then to hdpvr_free_buffers(),
where the lists are dereferenced.
The patch moves INIT_LIST_HEAD before the first possible fail.
Signed-off-by: Alexey Khoroshilov <khoroshi...@ispras.ru>
---
drivers/media/video/hdpvr/hdpvr-core.c | 8 ++++----
1 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/media/video/hdpvr/hdpvr-core.c
b/drivers/media/video/hdpvr/hdpvr-core.c
index 441dacf..fe0a088 100644
--- a/drivers/media/video/hdpvr/hdpvr-core.c
+++ b/drivers/media/video/hdpvr/hdpvr-core.c
@@ -295,6 +295,10 @@ static int hdpvr_probe(struct usb_interface *interface,
goto error;
}
+ /* init video transfer queues */
+ INIT_LIST_HEAD(&dev->free_buff_list);
+ INIT_LIST_HEAD(&dev->rec_buff_list);
+
dev->workqueue = 0;
/* register v4l2_device early so it can be used for printks */
@@ -319,10 +323,6 @@ static int hdpvr_probe(struct usb_interface *interface,
if (!dev->workqueue)
goto error;
- /* init video transfer queues */
- INIT_LIST_HEAD(&dev->free_buff_list);
- INIT_LIST_HEAD(&dev->rec_buff_list);
-
dev->options = hdpvr_default_options;
if (default_video_input < HDPVR_VIDEO_INPUTS)
--
1.7.4.1
--
To unsubscribe from this list: send the line "unsubscribe linux-media" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
