[media] v4l: make sure drivers supply a zeroed struct v4l2_subdev
Some v4l drivers currently don't initialize their struct v4l2_subdev
with zeros, and this is a problem since some of the v4l2 code expects
this. One example is the addition of internal_ops in commit 45f6f84
,
after that we are at risk of random oopses with these drivers when code
in v4l2_device_register_subdev tries to dereference sd->internal_ops->*,
as can be shown by the report at http://bugs.launchpad.net/bugs/745213
and analysis of its crash at https://lkml.org/lkml/2011/4/1/168
Use kzalloc within problematic drivers to ensure we have a zeroed struct
v4l2_subdev.
BugLink: http://bugs.launchpad.net/bugs/745213
Cc: <stable@kernel.org>
Signed-off-by: Herton Ronaldo Krzesinski <herton.krzesinski@canonical.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
This commit is contained in:
parent
2b5cb549f8
commit
80845a3316
|
@ -376,7 +376,7 @@ static int __devinit saa7706h_probe(struct i2c_client *client,
|
|||
v4l_info(client, "chip found @ 0x%02x (%s)\n",
|
||||
client->addr << 1, client->adapter->name);
|
||||
|
||||
state = kmalloc(sizeof(struct saa7706h_state), GFP_KERNEL);
|
||||
state = kzalloc(sizeof(struct saa7706h_state), GFP_KERNEL);
|
||||
if (state == NULL)
|
||||
return -ENOMEM;
|
||||
sd = &state->sd;
|
||||
|
|
|
@ -176,7 +176,7 @@ static int __devinit tef6862_probe(struct i2c_client *client,
|
|||
v4l_info(client, "chip found @ 0x%02x (%s)\n",
|
||||
client->addr << 1, client->adapter->name);
|
||||
|
||||
state = kmalloc(sizeof(struct tef6862_state), GFP_KERNEL);
|
||||
state = kzalloc(sizeof(struct tef6862_state), GFP_KERNEL);
|
||||
if (state == NULL)
|
||||
return -ENOMEM;
|
||||
state->freq = TEF6862_LO_FREQ;
|
||||
|
|
|
@ -174,7 +174,7 @@ static int m52790_probe(struct i2c_client *client,
|
|||
v4l_info(client, "chip found @ 0x%x (%s)\n",
|
||||
client->addr << 1, client->adapter->name);
|
||||
|
||||
state = kmalloc(sizeof(struct m52790_state), GFP_KERNEL);
|
||||
state = kzalloc(sizeof(struct m52790_state), GFP_KERNEL);
|
||||
if (state == NULL)
|
||||
return -ENOMEM;
|
||||
|
||||
|
|
|
@ -171,7 +171,7 @@ static int tda9840_probe(struct i2c_client *client,
|
|||
v4l_info(client, "chip found @ 0x%x (%s)\n",
|
||||
client->addr << 1, client->adapter->name);
|
||||
|
||||
sd = kmalloc(sizeof(struct v4l2_subdev), GFP_KERNEL);
|
||||
sd = kzalloc(sizeof(struct v4l2_subdev), GFP_KERNEL);
|
||||
if (sd == NULL)
|
||||
return -ENOMEM;
|
||||
v4l2_i2c_subdev_init(sd, client, &tda9840_ops);
|
||||
|
|
|
@ -152,7 +152,7 @@ static int tea6415c_probe(struct i2c_client *client,
|
|||
|
||||
v4l_info(client, "chip found @ 0x%x (%s)\n",
|
||||
client->addr << 1, client->adapter->name);
|
||||
sd = kmalloc(sizeof(struct v4l2_subdev), GFP_KERNEL);
|
||||
sd = kzalloc(sizeof(struct v4l2_subdev), GFP_KERNEL);
|
||||
if (sd == NULL)
|
||||
return -ENOMEM;
|
||||
v4l2_i2c_subdev_init(sd, client, &tea6415c_ops);
|
||||
|
|
|
@ -125,7 +125,7 @@ static int tea6420_probe(struct i2c_client *client,
|
|||
v4l_info(client, "chip found @ 0x%x (%s)\n",
|
||||
client->addr << 1, client->adapter->name);
|
||||
|
||||
sd = kmalloc(sizeof(struct v4l2_subdev), GFP_KERNEL);
|
||||
sd = kzalloc(sizeof(struct v4l2_subdev), GFP_KERNEL);
|
||||
if (sd == NULL)
|
||||
return -ENOMEM;
|
||||
v4l2_i2c_subdev_init(sd, client, &tea6420_ops);
|
||||
|
|
|
@ -230,7 +230,7 @@ static int upd64031a_probe(struct i2c_client *client,
|
|||
v4l_info(client, "chip found @ 0x%x (%s)\n",
|
||||
client->addr << 1, client->adapter->name);
|
||||
|
||||
state = kmalloc(sizeof(struct upd64031a_state), GFP_KERNEL);
|
||||
state = kzalloc(sizeof(struct upd64031a_state), GFP_KERNEL);
|
||||
if (state == NULL)
|
||||
return -ENOMEM;
|
||||
sd = &state->sd;
|
||||
|
|
|
@ -202,7 +202,7 @@ static int upd64083_probe(struct i2c_client *client,
|
|||
v4l_info(client, "chip found @ 0x%x (%s)\n",
|
||||
client->addr << 1, client->adapter->name);
|
||||
|
||||
state = kmalloc(sizeof(struct upd64083_state), GFP_KERNEL);
|
||||
state = kzalloc(sizeof(struct upd64083_state), GFP_KERNEL);
|
||||
if (state == NULL)
|
||||
return -ENOMEM;
|
||||
sd = &state->sd;
|
||||
|
|
Loading…
Reference in a new issue