TDA1997x driver tried to hold two values in a single variable:
device's "client data" pointer was first set to "sd" in
v4l2_i2c_subdev_init(), then it was overwritten explicitly
using dev_set_drvdata() with "state". This caused
tda1997x_remove() to fail badly.
Signed-off-by: Krzysztof Hałasa <[email protected]>
diff --git a/drivers/media/i2c/tda1997x.c b/drivers/media/i2c/tda1997x.c
index 17be95c0dcb3..fb37918b7fb5 100644
--- a/drivers/media/i2c/tda1997x.c
+++ b/drivers/media/i2c/tda1997x.c
@@ -2490,7 +2490,8 @@ static const struct media_entity_operations tda1997x_media_ops = {
static int tda1997x_pcm_startup(struct snd_pcm_substream *substream,
struct snd_soc_dai *dai)
{
- struct tda1997x_state *state = snd_soc_dai_get_drvdata(dai);
+ struct v4l2_subdev *sd = snd_soc_dai_get_drvdata(dai);
+ struct tda1997x_state *state = to_state(sd);
struct snd_soc_component *component = dai->component;
struct snd_pcm_runtime *rtd = substream->runtime;
int rate, err;
@@ -2799,7 +2800,6 @@ static int tda1997x_probe(struct i2c_client *client,
dev_err(&client->dev, "register audio codec failed\n");
goto err_free_media;
}
- dev_set_drvdata(&state->client->dev, state);
v4l_info(state->client, "registered audio codec\n");
}
--
Krzysztof "Chris" Hałasa
Sieć Badawcza Łukasiewicz
Przemysłowy Instytut Automatyki i Pomiarów PIAP
Al. Jerozolimskie 202, 02-486 Warszawa
On Thu, Jul 29, 2021 at 11:59 PM Krzysztof Hałasa <[email protected]> wrote:
>
> TDA1997x driver tried to hold two values in a single variable:
> device's "client data" pointer was first set to "sd" in
> v4l2_i2c_subdev_init(), then it was overwritten explicitly
> using dev_set_drvdata() with "state". This caused
> tda1997x_remove() to fail badly.
>
> Signed-off-by: Krzysztof Hałasa <[email protected]>
>
> diff --git a/drivers/media/i2c/tda1997x.c b/drivers/media/i2c/tda1997x.c
> index 17be95c0dcb3..fb37918b7fb5 100644
> --- a/drivers/media/i2c/tda1997x.c
> +++ b/drivers/media/i2c/tda1997x.c
> @@ -2490,7 +2490,8 @@ static const struct media_entity_operations tda1997x_media_ops = {
> static int tda1997x_pcm_startup(struct snd_pcm_substream *substream,
> struct snd_soc_dai *dai)
> {
> - struct tda1997x_state *state = snd_soc_dai_get_drvdata(dai);
> + struct v4l2_subdev *sd = snd_soc_dai_get_drvdata(dai);
> + struct tda1997x_state *state = to_state(sd);
> struct snd_soc_component *component = dai->component;
> struct snd_pcm_runtime *rtd = substream->runtime;
> int rate, err;
> @@ -2799,7 +2800,6 @@ static int tda1997x_probe(struct i2c_client *client,
> dev_err(&client->dev, "register audio codec failed\n");
> goto err_free_media;
> }
> - dev_set_drvdata(&state->client->dev, state);
> v4l_info(state->client, "registered audio codec\n");
> }
>
>
Acked-By: Tim Harvey <[email protected]>
Tim