Skip to content

Commit a3a54bf

Browse files
lztomchehab
authored andcommitted
media: bt878: do not schedule tasklet when it is not setup
There is a problem with the tasklet in bt878. bt->tasklet is set by dvb-bt8xx.ko, and bt878.ko can be loaded independently. In this case if interrupt comes it may cause null-ptr-dereference. To solve this issue, we check if the tasklet is actually set before calling tasklet_schedule. [ 1.750438] bt878(0): irq FDSR FBUS risc_pc= [ 1.750728] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 1.752969] RIP: 0010:0x0 [ 1.757526] Call Trace: [ 1.757659] <IRQ> [ 1.757770] tasklet_action_common.isra.0+0x107/0x110 [ 1.758041] tasklet_action+0x22/0x30 [ 1.758237] __do_softirq+0xe0/0x29b [ 1.758430] irq_exit_rcu+0xa4/0xb0 [ 1.758618] common_interrupt+0x8d/0xa0 [ 1.758824] </IRQ> Signed-off-by: Tong Zhang <ztong0001@gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
1 parent 14480e8 commit a3a54bf

File tree

1 file changed

+2
-1
lines changed

1 file changed

+2
-1
lines changed

drivers/media/pci/bt8xx/bt878.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -300,7 +300,8 @@ static irqreturn_t bt878_irq(int irq, void *dev_id)
300300
}
301301
if (astat & BT878_ARISCI) {
302302
bt->finished_block = (stat & BT878_ARISCS) >> 28;
303-
tasklet_schedule(&bt->tasklet);
303+
if (bt->tasklet.callback)
304+
tasklet_schedule(&bt->tasklet);
304305
break;
305306
}
306307
count++;

0 commit comments

Comments
 (0)