Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1044474AbdDWJ2P (ORCPT ); Sun, 23 Apr 2017 05:28:15 -0400 Received: from m50-134.163.com ([123.125.50.134]:46289 "EHLO m50-134.163.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1044380AbdDWJ0w (ORCPT ); Sun, 23 Apr 2017 05:26:52 -0400 From: Pan Bian To: Erik Andren , Hans Verkuil , Mauro Carvalho Chehab Cc: linux-media@vger.kernel.org, linux-kernel@vger.kernel.org, Pan Bian Subject: [PATCH 1/1] m5602_s5k83a: check return value of kthread_create Date: Sun, 23 Apr 2017 17:26:45 +0800 Message-Id: <1492939605-25977-1-git-send-email-bianpan201602@163.com> X-Mailer: git-send-email 1.9.1 X-CM-TRANSID: DtGowADHvRZVc_xYZjTqAA--.535S3 X-Coremail-Antispam: 1Uf129KBjvdXoWruF17XrWxJr4fJr4fGrW3ZFb_yoWkJFc_u3 ZrAF4I9r1xtr1rXr1Y9348AFW09r48Cr10qFy5t3y3AF1xCw4kZrnFvrn8JFW7u3s7urnx AryfZF1Fk3sxGjkaLaAFLSUrUUUUUb8apTn2vfkv8UJUUUU8Yxn0WfASr-VFAUDa7-sFnT 9fnUUvcSsGvfC2KfnxnUUI43ZEXa7IUnczVUUUUUU== X-Originating-IP: [123.118.194.153] X-CM-SenderInfo: held01tdqsiiqwqsqiywtou0bp/1tbiuBlz4FQG7yBDAAABst Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1051 Lines: 30 From: Pan Bian Function kthread_create() returns an ERR_PTR on error. However, in function s5k83a_start(), its return value is used without validation. This may result in a bad memory access bug. This patch fixes the bug. Signed-off-by: Pan Bian --- drivers/media/usb/gspca/m5602/m5602_s5k83a.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/media/usb/gspca/m5602/m5602_s5k83a.c b/drivers/media/usb/gspca/m5602/m5602_s5k83a.c index be5e25d1..6ad8d48 100644 --- a/drivers/media/usb/gspca/m5602/m5602_s5k83a.c +++ b/drivers/media/usb/gspca/m5602/m5602_s5k83a.c @@ -345,6 +345,11 @@ int s5k83a_start(struct sd *sd) to assume that there is no better way of accomplishing this */ sd->rotation_thread = kthread_create(rotation_thread_function, sd, "rotation thread"); + if (IS_ERR(sd->rotation_thread)) { + err = PTR_ERR(sd->rotation_thread); + sd->rotation_thread = NULL; + return err; + } wake_up_process(sd->rotation_thread); /* Preinit the sensor */ -- 1.9.1