[PATCH] TDA1997x: fix tda1997x_remove()

[PATCH] TDA1997x: fix tda1997x_remove()

[Krzysztof Hałasa]

TDA1997x I2C "client data" pointer was never set in tda1997x_probe(),
then the code tried to use invalid pointer in tda1997x_remove().

Signed-off-by: Krzysztof Hałasa <khalasa@piap.pl>

diff --git a/drivers/media/i2c/tda1997x.c b/drivers/media/i2c/tda1997x.c
index 71194746c874..043cc8275d00 100644
--- a/drivers/media/i2c/tda1997x.c
+++ b/drivers/media/i2c/tda1997x.c
@@ -2771,6 +2771,7 @@ static int tda1997x_probe(struct i2c_client *client,
 		goto err_free_media;
 	}
 
+	i2c_set_clientdata(client, sd);
 	return 0;
 
 err_free_media:

Re: [PATCH] TDA1997x: fix tda1997x_remove()

[Hans Verkuil]

On 26/07/2021 12:44, Krzysztof Hałasa wrote:
> TDA1997x I2C "client data" pointer was never set in tda1997x_probe(),
> then the code tried to use invalid pointer in tda1997x_remove().
> 
> Signed-off-by: Krzysztof Hałasa <khalasa@piap.pl>
> 
> diff --git a/drivers/media/i2c/tda1997x.c b/drivers/media/i2c/tda1997x.c
> index 71194746c874..043cc8275d00 100644
> --- a/drivers/media/i2c/tda1997x.c
> +++ b/drivers/media/i2c/tda1997x.c
> @@ -2771,6 +2771,7 @@ static int tda1997x_probe(struct i2c_client *client,
>  		goto err_free_media;
>  	}
>  
> +	i2c_set_clientdata(client, sd);
>  	return 0;
>  
>  err_free_media:
> 

Actually, v4l2_i2c_subdev_init() sets this, and v4l2_i2c_subdev_init() *is* called.
Does it really crash in tda1997x_remove() without this patch?

If so, then I suspect something else is going on.

Regards,

	Hans

Re: [PATCH] TDA1997x: fix tda1997x_remove()

[Krzysztof Hałasa]

Hans,

Hans Verkuil <hverkuil@xs4all.nl> writes:

>> +++ b/drivers/media/i2c/tda1997x.c
>> @@ -2771,6 +2771,7 @@ static int tda1997x_probe(struct i2c_client *client,
>>  		goto err_free_media;
>>  	}
>>  
>> +	i2c_set_clientdata(client, sd);
>>  	return 0;
>>  
>>  err_free_media:
>> 
>
> Actually, v4l2_i2c_subdev_init() sets this, and v4l2_i2c_subdev_init() *is* called.
> Does it really crash in tda1997x_remove() without this patch?

Yes, the pointer was once invalid (IIRC), and in other cases NULL.

> If so, then I suspect something else is going on.

I'll investigate further, then.

Thanks,
-- 
Krzysztof "Chris" Hałasa

Sieć Badawcza Łukasiewicz
Przemysłowy Instytut Automatyki i Pomiarów PIAP
Al. Jerozolimskie 202, 02-486 Warszawa