Commit e3b86f4e authored by Corentin Labbe's avatar Corentin Labbe Committed by Mauro Carvalho Chehab
Browse files

media: staging: media: zoran: calculate the right buffer number for zoran_reap_stat_com 



On the case tmp_dcim=1, the index of buffer is miscalculated.
This generate a NULL pointer dereference later.

So let's fix the calcul and add a check to prevent this to reappear.

Signed-off-by: default avatarCorentin Labbe <clabbe@baylibre.com>
Signed-off-by: default avatarHans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@kernel.org>
parent 4e3edddb

drivers/staging/media/zoran/zoran_device.c

+6 −1
Original line number Diff line number Diff line
@@ -814,7 +814,7 @@ static void zoran_reap_stat_com(struct zoran *zr) 
		if (zr->jpg_settings.tmp_dcm == 1)

			i = (zr->jpg_dma_tail - zr->jpg_err_shift) & BUZ_MASK_STAT_COM;

		else

			i = ((zr->jpg_dma_tail - zr->jpg_err_shift) & 1) * 2 + 1;

			i = ((zr->jpg_dma_tail - zr->jpg_err_shift) & 1) * 2;



		stat_com = le32_to_cpu(zr->stat_com[i]);

		if ((stat_com & 1) == 0) {
@@ -826,6 +826,11 @@ static void zoran_reap_stat_com(struct zoran *zr) 
		size = (stat_com & GENMASK(22, 1)) >> 1;



		buf = zr->inuse[i];

		if (!buf) {

			spin_unlock_irqrestore(&zr->queued_bufs_lock, flags);

			pci_err(zr->pci_dev, "No buffer at slot %d\n", i);

			return;

		}

		buf->vbuf.vb2_buf.timestamp = ktime_get_ns();



		if (zr->codec_mode == BUZ_MODE_MOTION_COMPRESS) {