From 7a81513e6cba3f255c0ac8a31480c9770fe83b0d Mon Sep 17 00:00:00 2001 From: Michael Hunold Date: Sun, 3 Apr 2005 18:05:31 -0700 Subject: [PATCH] Fix Oops in MXB driver (v4l2 subsystem) This fixes a NULL pointer dereference Oops in my "Multimedia eXtension Board" driver. The tda9840 i2c driver dereferences the argument pointer, but the MXB driver is supplying a NULL pointer for one of the commands. The patch makes this one command behave like the others, ie. it expects an int argument. Signed-off-by: Linus Torvalds --- drivers/media/video/mxb.c | 2 +- drivers/media/video/tda9840.c | 9 ++++++--- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/drivers/media/video/mxb.c b/drivers/media/video/mxb.c index a76571ddd03c9..70bf1f1fad599 100644 --- a/drivers/media/video/mxb.c +++ b/drivers/media/video/mxb.c @@ -731,7 +731,7 @@ static int mxb_ioctl(struct saa7146_fh *fh, unsigned int cmd, void *arg) t->signal = 0xffff; t->afc = 0; - byte = mxb->tda9840->driver->command(mxb->tda9840,TDA9840_DETECT, NULL); + mxb->tda9840->driver->command(mxb->tda9840,TDA9840_DETECT, &byte); t->audmode = mxb->cur_mode; if( byte < 0 ) { diff --git a/drivers/media/video/tda9840.c b/drivers/media/video/tda9840.c index 8de20ad14e9b2..b5177c6f54f6a 100644 --- a/drivers/media/video/tda9840.c +++ b/drivers/media/video/tda9840.c @@ -117,7 +117,8 @@ static int command(struct i2c_client *client, unsigned int cmd, void *arg) dprintk("i2c_smbus_write_byte() failed, ret:%d\n", result); break; - case TDA9840_DETECT: + case TDA9840_DETECT: { + int *ret = (int *)arg; byte = i2c_smbus_read_byte_data(client, STEREO_ADJUST); if (byte == -1) { @@ -131,8 +132,10 @@ static int command(struct i2c_client *client, unsigned int cmd, void *arg) } dprintk("TDA9840_DETECT: byte: 0x%02x\n", byte); - return ((byte & 0x60) >> 5); - + *ret = ((byte & 0x60) >> 5); + result = 0; + break; + } case TDA9840_TEST: dprintk("TDA9840_TEST: 0x%02x\n", byte); -- cgit 1.2.3-korg