Hi! Am Sonntag, den 07.02.2010, 10:13 -0500 schrieb Andy Walls: > On Sun, 2010-02-07 at 13:49 +0100, Francesco Lavra wrote: > > A DVB demultiplexer device can be used to set up either a PES filter or > > a section filter. In the former case, the ts field of the feed union of > > struct dmxdev_filter is used, in the latter case the sec field of the > > same union is used. > > The ts field is a struct list_head, and is currently initialized in the > > open() method of the demux device. When for a given demuxer a section > > filter is set up, the sec field is played with, thus if a PES filter > > needs to be set up after that the ts field will be corrupted, causing a > > kernel oops. > > This fix moves the list head initialization to > > dvb_dmxdev_pes_filter_set(), so that the ts field is properly > > initialized every time a PES filter is set up. > > > > Signed-off-by: Francesco Lavra <francescolavra@xxxxxxxxxxxx> > > Cc: stable <stable@xxxxxxxxxx> > > > Reviewed-by: Andy Walls <awalls@xxxxxxxxx> Tested-by: hermann pitton <hermann-pitton@xxxxxxxx> > > This certainly helps. Yes, as already confirmed by Uwe. > It catches the case of setting a Section filter with DMX_SET_FILTER and > then a PES filter with DMX_SET_PES_FILTER on the same file descriptor. > This is exactly what alevt does. See vbi.c:vbi_dvb_open() and > vbi.c:dvb_get_table() in the alevt source code. > > > Regards, > Andy > > > --- > > > > --- a/drivers/media/dvb/dvb-core/dmxdev.c 2010-02-07 13:19:18.000000000 +0100 > > +++ b/drivers/media/dvb/dvb-core/dmxdev.c 2010-02-07 13:23:39.000000000 +0100 > > @@ -761,7 +761,6 @@ static int dvb_demux_open(struct inode * > > dvb_ringbuffer_init(&dmxdevfilter->buffer, NULL, 8192); > > dmxdevfilter->type = DMXDEV_TYPE_NONE; > > dvb_dmxdev_filter_state_set(dmxdevfilter, DMXDEV_STATE_ALLOCATED); > > - INIT_LIST_HEAD(&dmxdevfilter->feed.ts); > > init_timer(&dmxdevfilter->timer); > > > > dvbdev->users++; > > @@ -887,6 +886,7 @@ static int dvb_dmxdev_pes_filter_set(str > > dmxdevfilter->type = DMXDEV_TYPE_PES; > > memcpy(&dmxdevfilter->params, params, > > sizeof(struct dmx_pes_filter_params)); > > + INIT_LIST_HEAD(&dmxdevfilter->feed.ts); > > > > dvb_dmxdev_filter_state_set(dmxdevfilter, DMXDEV_STATE_SET); > > > > Many thanks to Francesco and all taking it up with this one. Cheers, Hermann -- To unsubscribe from this list: send the line "unsubscribe linux-media" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
