path: root/drivers/media/pci/cx88/cx88-video.c
diff options
authorHans Verkuil <hverkuil@xs4all.nl>2013-05-29 10:44:22 -0300
committerMauro Carvalho Chehab <mchehab@redhat.com>2013-06-08 20:24:56 -0300
commit609c4c12af79b1ba5fd2d31727a95dd3a319c0ae (patch)
tree31d41ee5768f3d3ef56ad0c4d8aa75fb12a41a22 /drivers/media/pci/cx88/cx88-video.c
parentdfd50fc9030a62521838eecbe488e1962edcba80 (diff)
[media] cx88: fix NULL pointer dereference
This fixes a NULL pointer deference when loading the cx88_dvb module for a Hauppauge HVR4000. The bugzilla bug report is here: https://bugzilla.kernel.org/show_bug.cgi?id=56271 The cause is that the wm8775 is optional, so even though the board info says there is one, it doesn't have to be there. Checking whether the module was actually loaded is much safer. Note that this driver is quite buggy when it comes to unloading and reloading modules. Unloading cx8800 and reloading it again will still cause a crash, most likely because either the i2c bus isn't unloaded at the right time and/or the v4l2_device_unregister isn't called at the right time. Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Reported-by: Sebastian Frei <sebastian@familie-frei.net> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Diffstat (limited to 'drivers/media/pci/cx88/cx88-video.c')
1 files changed, 3 insertions, 5 deletions
diff --git a/drivers/media/pci/cx88/cx88-video.c b/drivers/media/pci/cx88/cx88-video.c
index 1b00615fd39..c7a9be1065c 100644
--- a/drivers/media/pci/cx88/cx88-video.c
+++ b/drivers/media/pci/cx88/cx88-video.c
@@ -385,8 +385,7 @@ int cx88_video_mux(struct cx88_core *core, unsigned int input)
/* The wm8775 module has the "2" route hardwired into
the initialization. Some boards may use different
routes for different inputs. HVR-1300 surely does */
- if (core->board.audio_chip &&
- core->board.audio_chip == V4L2_IDENT_WM8775) {
+ if (core->sd_wm8775) {
call_all(core, audio, s_routing,
INPUT(input).audioroute, 0, 0);
@@ -771,8 +770,7 @@ static int video_open(struct file *file)
cx_write(MO_GP1_IO, core->board.radio.gpio1);
cx_write(MO_GP2_IO, core->board.radio.gpio2);
if (core->board.radio.audioroute) {
- if(core->board.audio_chip &&
- core->board.audio_chip == V4L2_IDENT_WM8775) {
+ if (core->sd_wm8775) {
call_all(core, audio, s_routing,
core->board.radio.audioroute, 0, 0);
@@ -959,7 +957,7 @@ static int cx8800_s_aud_ctrl(struct v4l2_ctrl *ctrl)
u32 value,mask;
/* Pass changes onto any WM8775 */
- if (core->board.audio_chip == V4L2_IDENT_WM8775) {
+ if (core->sd_wm8775) {
switch (ctrl->id) {
wm8775_s_ctrl(core, ctrl->id, ctrl->val);