diff options
| author | Michael Hunold <hunold@linuxtv.org> | 2005-04-03 18:05:31 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@ppc970.osdl.org> | 2005-04-03 18:05:31 -0700 |
| commit | 7a81513e6cba3f255c0ac8a31480c9770fe83b0d (patch) | |
| tree | a840f45cd831eea3625df021234b0c474481454e | |
| parent | 1f7abe86ce081437353b6f765e82f2eed1337427 (diff) | |
[PATCH] Fix Oops in MXB driver (v4l2 subsystem)
This fixes a NULL pointer dereference Oops in my "Multimedia eXtension
Board" driver.
The tda9840 i2c driver dereferences the argument pointer, but the MXB
driver is supplying a NULL pointer for one of the commands. The patch
makes this one command behave like the others, ie. it expects an int
argument.
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
| -rw-r--r-- | drivers/media/video/mxb.c | 2 | ||||
| -rw-r--r-- | drivers/media/video/tda9840.c | 9 |
2 files changed, 7 insertions, 4 deletions
diff --git a/drivers/media/video/mxb.c b/drivers/media/video/mxb.c index a76571ddd03c9..70bf1f1fad599 100644 --- a/drivers/media/video/mxb.c +++ b/drivers/media/video/mxb.c @@ -731,7 +731,7 @@ static int mxb_ioctl(struct saa7146_fh *fh, unsigned int cmd, void *arg) t->signal = 0xffff; t->afc = 0; - byte = mxb->tda9840->driver->command(mxb->tda9840,TDA9840_DETECT, NULL); + mxb->tda9840->driver->command(mxb->tda9840,TDA9840_DETECT, &byte); t->audmode = mxb->cur_mode; if( byte < 0 ) { diff --git a/drivers/media/video/tda9840.c b/drivers/media/video/tda9840.c index 8de20ad14e9b2..b5177c6f54f6a 100644 --- a/drivers/media/video/tda9840.c +++ b/drivers/media/video/tda9840.c @@ -117,7 +117,8 @@ static int command(struct i2c_client *client, unsigned int cmd, void *arg) dprintk("i2c_smbus_write_byte() failed, ret:%d\n", result); break; - case TDA9840_DETECT: + case TDA9840_DETECT: { + int *ret = (int *)arg; byte = i2c_smbus_read_byte_data(client, STEREO_ADJUST); if (byte == -1) { @@ -131,8 +132,10 @@ static int command(struct i2c_client *client, unsigned int cmd, void *arg) } dprintk("TDA9840_DETECT: byte: 0x%02x\n", byte); - return ((byte & 0x60) >> 5); - + *ret = ((byte & 0x60) >> 5); + result = 0; + break; + } case TDA9840_TEST: dprintk("TDA9840_TEST: 0x%02x\n", byte); |