LKML Archive on lore.kernel.org
help / color / mirror / Atom feed
* [PATCH v2] TDA1997x: fix tda1997x_remove()
@ 2021-07-30  6:59 Krzysztof Hałasa
  2021-08-19 18:57 ` Tim Harvey
  0 siblings, 1 reply; 2+ messages in thread
From: Krzysztof Hałasa @ 2021-07-30  6:59 UTC (permalink / raw)
  To: Tim Harvey; +Cc: Mauro Carvalho Chehab, linux-media, linux-kernel

TDA1997x driver tried to hold two values in a single variable:
device's "client data" pointer was first set to "sd" in
v4l2_i2c_subdev_init(), then it was overwritten explicitly
using dev_set_drvdata() with "state". This caused
tda1997x_remove() to fail badly.

Signed-off-by: Krzysztof Hałasa <khalasa@piap.pl>

diff --git a/drivers/media/i2c/tda1997x.c b/drivers/media/i2c/tda1997x.c
index 17be95c0dcb3..fb37918b7fb5 100644
--- a/drivers/media/i2c/tda1997x.c
+++ b/drivers/media/i2c/tda1997x.c
@@ -2490,7 +2490,8 @@ static const struct media_entity_operations tda1997x_media_ops = {
 static int tda1997x_pcm_startup(struct snd_pcm_substream *substream,
 				struct snd_soc_dai *dai)
 {
-	struct tda1997x_state *state = snd_soc_dai_get_drvdata(dai);
+	struct v4l2_subdev *sd = snd_soc_dai_get_drvdata(dai);
+	struct tda1997x_state *state = to_state(sd);
 	struct snd_soc_component *component = dai->component;
 	struct snd_pcm_runtime *rtd = substream->runtime;
 	int rate, err;
@@ -2799,7 +2800,6 @@ static int tda1997x_probe(struct i2c_client *client,
 			dev_err(&client->dev, "register audio codec failed\n");
 			goto err_free_media;
 		}
-		dev_set_drvdata(&state->client->dev, state);
 		v4l_info(state->client, "registered audio codec\n");
 	}
 

-- 
Krzysztof "Chris" Hałasa

Sieć Badawcza Łukasiewicz
Przemysłowy Instytut Automatyki i Pomiarów PIAP
Al. Jerozolimskie 202, 02-486 Warszawa

^ permalink raw reply	[flat|nested] 2+ messages in thread

* Re: [PATCH v2] TDA1997x: fix tda1997x_remove()
  2021-07-30  6:59 [PATCH v2] TDA1997x: fix tda1997x_remove() Krzysztof Hałasa
@ 2021-08-19 18:57 ` Tim Harvey
  0 siblings, 0 replies; 2+ messages in thread
From: Tim Harvey @ 2021-08-19 18:57 UTC (permalink / raw)
  To: Krzysztof Hałasa; +Cc: Mauro Carvalho Chehab, linux-media, open list

On Thu, Jul 29, 2021 at 11:59 PM Krzysztof Hałasa <khalasa@piap.pl> wrote:
>
> TDA1997x driver tried to hold two values in a single variable:
> device's "client data" pointer was first set to "sd" in
> v4l2_i2c_subdev_init(), then it was overwritten explicitly
> using dev_set_drvdata() with "state". This caused
> tda1997x_remove() to fail badly.
>
> Signed-off-by: Krzysztof Hałasa <khalasa@piap.pl>
>
> diff --git a/drivers/media/i2c/tda1997x.c b/drivers/media/i2c/tda1997x.c
> index 17be95c0dcb3..fb37918b7fb5 100644
> --- a/drivers/media/i2c/tda1997x.c
> +++ b/drivers/media/i2c/tda1997x.c
> @@ -2490,7 +2490,8 @@ static const struct media_entity_operations tda1997x_media_ops = {
>  static int tda1997x_pcm_startup(struct snd_pcm_substream *substream,
>                                 struct snd_soc_dai *dai)
>  {
> -       struct tda1997x_state *state = snd_soc_dai_get_drvdata(dai);
> +       struct v4l2_subdev *sd = snd_soc_dai_get_drvdata(dai);
> +       struct tda1997x_state *state = to_state(sd);
>         struct snd_soc_component *component = dai->component;
>         struct snd_pcm_runtime *rtd = substream->runtime;
>         int rate, err;
> @@ -2799,7 +2800,6 @@ static int tda1997x_probe(struct i2c_client *client,
>                         dev_err(&client->dev, "register audio codec failed\n");
>                         goto err_free_media;
>                 }
> -               dev_set_drvdata(&state->client->dev, state);
>                 v4l_info(state->client, "registered audio codec\n");
>         }
>
>

Acked-By: Tim Harvey <tharvey@gateworks.com>

Tim

^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, other threads:[~2021-08-19 18:57 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-07-30  6:59 [PATCH v2] TDA1997x: fix tda1997x_remove() Krzysztof Hałasa
2021-08-19 18:57 ` Tim Harvey

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).