2021-07-26 10:45:55

by Krzysztof Hałasa

Subject: [PATCH] TDA1997x: fix tda1997x_remove()

TDA1997x I2C "client data" pointer was never set in tda1997x_probe(),
then the code tried to use invalid pointer in tda1997x_remove().

Signed-off-by: Krzysztof Hałasa <[email protected]>

diff --git a/drivers/media/i2c/tda1997x.c b/drivers/media/i2c/tda1997x.c
index 71194746c874..043cc8275d00 100644
--- a/drivers/media/i2c/tda1997x.c
+++ b/drivers/media/i2c/tda1997x.c
@@ -2771,6 +2771,7 @@ static int tda1997x_probe(struct i2c_client *client,
goto err_free_media;
}

+ i2c_set_clientdata(client, sd);
return 0;

err_free_media:

2021-07-29 09:56:46

by Hans Verkuil

Subject: Re: [PATCH] TDA1997x: fix tda1997x_remove()

On 26/07/2021 12:44, Krzysztof Hałasa wrote:
> TDA1997x I2C "client data" pointer was never set in tda1997x_probe(),
> then the code tried to use invalid pointer in tda1997x_remove().
>
> Signed-off-by: Krzysztof Hałasa <[email protected]>
>
> diff --git a/drivers/media/i2c/tda1997x.c b/drivers/media/i2c/tda1997x.c
> index 71194746c874..043cc8275d00 100644
> --- a/drivers/media/i2c/tda1997x.c
> +++ b/drivers/media/i2c/tda1997x.c
> @@ -2771,6 +2771,7 @@ static int tda1997x_probe(struct i2c_client *client,
> goto err_free_media;
> }
>
> + i2c_set_clientdata(client, sd);
> return 0;
>
> err_free_media:
>

Actually, v4l2_i2c_subdev_init() sets this, and v4l2_i2c_subdev_init() *is* called.
Does it really crash in tda1997x_remove() without this patch?

If so, then I suspect something else is going on.

Regards,

Hans

2021-07-29 11:08:56

by Krzysztof Hałasa

Subject: Re: [PATCH] TDA1997x: fix tda1997x_remove()

Hans,

Hans Verkuil <[email protected]> writes:

>> +++ b/drivers/media/i2c/tda1997x.c
>> @@ -2771,6 +2771,7 @@ static int tda1997x_probe(struct i2c_client *client,
>> goto err_free_media;
>> }
>>
>> + i2c_set_clientdata(client, sd);
>> return 0;
>>
>> err_free_media:
>>
>
> Actually, v4l2_i2c_subdev_init() sets this, and v4l2_i2c_subdev_init() *is* called.
> Does it really crash in tda1997x_remove() without this patch?

Yes, the pointer was once invalid (IIRC), and in other cases NULL.

> If so, then I suspect something else is going on.

I'll investigate further, then.

Thanks,
--
Krzysztof "Chris" Hałasa

Sieć Badawcza Łukasiewicz
Przemysłowy Instytut Automatyki i Pomiarów PIAP
Al. Jerozolimskie 202, 02-486 Warszawa