| Message ID | m3tukc9tiw.fsf@t19.piap.pl (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | [v2] TDA1997x: fix tda1997x_remove() | expand |
On Thu, Jul 29, 2021 at 11:59 PM Krzysztof Hałasa <khalasa@piap.pl> wrote: > > TDA1997x driver tried to hold two values in a single variable: > device's "client data" pointer was first set to "sd" in > v4l2_i2c_subdev_init(), then it was overwritten explicitly > using dev_set_drvdata() with "state". This caused > tda1997x_remove() to fail badly. > > Signed-off-by: Krzysztof Hałasa <khalasa@piap.pl> > > diff --git a/drivers/media/i2c/tda1997x.c b/drivers/media/i2c/tda1997x.c > index 17be95c0dcb3..fb37918b7fb5 100644 > --- a/drivers/media/i2c/tda1997x.c > +++ b/drivers/media/i2c/tda1997x.c > @@ -2490,7 +2490,8 @@ static const struct media_entity_operations tda1997x_media_ops = { > static int tda1997x_pcm_startup(struct snd_pcm_substream *substream, > struct snd_soc_dai *dai) > { > - struct tda1997x_state *state = snd_soc_dai_get_drvdata(dai); > + struct v4l2_subdev *sd = snd_soc_dai_get_drvdata(dai); > + struct tda1997x_state *state = to_state(sd); > struct snd_soc_component *component = dai->component; > struct snd_pcm_runtime *rtd = substream->runtime; > int rate, err; > @@ -2799,7 +2800,6 @@ static int tda1997x_probe(struct i2c_client *client, > dev_err(&client->dev, "register audio codec failed\n"); > goto err_free_media; > } > - dev_set_drvdata(&state->client->dev, state); > v4l_info(state->client, "registered audio codec\n"); > } > > Acked-By: Tim Harvey <tharvey@gateworks.com> Tim
diff --git a/drivers/media/i2c/tda1997x.c b/drivers/media/i2c/tda1997x.c index 17be95c0dcb3..fb37918b7fb5 100644 --- a/drivers/media/i2c/tda1997x.c +++ b/drivers/media/i2c/tda1997x.c @@ -2490,7 +2490,8 @@ static const struct media_entity_operations tda1997x_media_ops = { static int tda1997x_pcm_startup(struct snd_pcm_substream *substream, struct snd_soc_dai *dai) { - struct tda1997x_state *state = snd_soc_dai_get_drvdata(dai); + struct v4l2_subdev *sd = snd_soc_dai_get_drvdata(dai); + struct tda1997x_state *state = to_state(sd); struct snd_soc_component *component = dai->component; struct snd_pcm_runtime *rtd = substream->runtime; int rate, err; @@ -2799,7 +2800,6 @@ static int tda1997x_probe(struct i2c_client *client, dev_err(&client->dev, "register audio codec failed\n"); goto err_free_media; } - dev_set_drvdata(&state->client->dev, state); v4l_info(state->client, "registered audio codec\n"); }
TDA1997x driver tried to hold two values in a single variable: device's "client data" pointer was first set to "sd" in v4l2_i2c_subdev_init(), then it was overwritten explicitly using dev_set_drvdata() with "state". This caused tda1997x_remove() to fail badly. Signed-off-by: Krzysztof Hałasa <khalasa@piap.pl>