Skip to contentSkip to conversation

cx231xx: cx231xx_uninit_bulk attempts to reference and free isoc_ctl instead of bulk_ctl

PATCH New Luke Suchocki 1 participant 1 message Sep 29, 2014 Media (V4L/DVB)

lore
Share & tools
lore
#0 lore raw

PATCH 1/1 cx231xx: cx231xx_uninit_bulk attempts to reference and free isoc_ctl instead of bulk_ctl

cx231xx_uninit_bulk() checks that dev->video_mode.bulk_ctl.transfer_buffer[i] is not NULL, but then calls usb_free_cohert() with dev->video_mode.isoc_ctl.transfer_buffer[i] resulting in "BUG: unable to handle NULL pointer dereference" when closing stream; most likely a cut-and-paste slip from previous uninit_isoc function.

This will present itself when cx231xx.ko is loaded with "transfer_mode=0" (USB bulk transfers).

--- a/drivers/media/usb/cx231xx/cx231xx-core.c 2014-09-29 13:06:52.006326612 -0500
+++ b/drivers/media/usb/cx231xx/cx231xx-core.c 2014-09-29 13:10:46.796695980 -0500
@@ -943,7 +943,7 @@ void cx231xx_uninit_bulk(struct cx231xx

                        if (dev->video_mode.bulk_ctl.transfer_buffer[i])
{
                                usb_free_coherent(dev->udev,

urb->transfer_buffer_length,
-
dev->video_mode.isoc_ctl.
+
dev->video_mode.bulk_ctl.

                                                transfer_buffer[i],
                                                urb->transfer_dma);