Showing error 1809

User: Jiri Slaby
Error type: Invalid Pointer Dereference
Error type description: A pointer which is invalid is being dereferenced
File location: drivers/media/video/ivtv/ivtv-queue.c
Line in file: 145
Project: Linux Kernel
Project version: 2.6.28
Tools: Smatch (1.59)
Entered: 2013-09-11 08:47:26 UTC

Source: 

115   available buffer length, otherwise needed_bytes is compared to the
116   bytesused value. For the 'steal' queue the total available buffer
117   length is always used.
118
119   -ENOMEM is returned if the buffers could not be obtained, 0 if all
120   buffers where obtained from the 'from' list and if non-zero then
121   the number of stolen buffers is returned. */
122int ivtv_queue_move(struct ivtv_stream *s, struct ivtv_queue *from, struct ivtv_queue *steal,
123                    struct ivtv_queue *to, int needed_bytes)
124{
125        unsigned long flags;
126        int rc = 0;
127        int from_free = from == &s->q_free;
128        int to_free = to == &s->q_free;
129        int bytes_available, bytes_steal;
130
131        spin_lock_irqsave(&s->qlock, flags);
132        if (needed_bytes == 0) {
133                from_free = 1;
134                needed_bytes = from->length;
135        }
136
137        bytes_available = from_free ? from->length : from->bytesused;
138        bytes_steal = (from_free && steal) ? steal->length : 0;
139
140        if (bytes_available + bytes_steal < needed_bytes) {
141                spin_unlock_irqrestore(&s->qlock, flags);
142                return -ENOMEM;
143        }
144        while (bytes_available < needed_bytes) {
145                struct ivtv_buffer *buf = list_entry(steal->list.prev, struct ivtv_buffer, list);
146                u16 dma_xfer_cnt = buf->dma_xfer_cnt;
147
148                /* move buffers from the tail of the 'steal' queue to the tail of the
149                   'from' queue. Always copy all the buffers with the same dma_xfer_cnt
150                   value, this ensures that you do not end up with partial frame data
151                   if one frame is stored in multiple buffers. */
152                while (dma_xfer_cnt == buf->dma_xfer_cnt) {
153                        list_move_tail(steal->list.prev, &from->list);
154                        rc++;
155                        steal->buffers--;
Show full sources
↑