cx231xx: cx231xx_uninit_bulk attempts to reference and free isoc_ctl instead of bulk_ctl
PATCH 1/1 cx231xx: cx231xx_uninit_bulk attempts to reference and free isoc_ctl instead of bulk_ctl
cx231xx_uninit_bulk() checks that dev->video_mode.bulk_ctl.transfer_buffer[i] is not NULL, but then calls usb_free_cohert() with dev->video_mode.isoc_ctl.transfer_buffer[i] resulting in "BUG: unable to handle NULL pointer dereference" when closing stream; most likely a cut-and-paste slip from previous uninit_isoc function.
This will present itself when cx231xx.ko is loaded with "transfer_mode=0" (USB bulk transfers).
--- a/drivers/media/usb/cx231xx/cx231xx-core.c 2014-09-29 13:06:52.006326612 -0500
+++ b/drivers/media/usb/cx231xx/cx231xx-core.c 2014-09-29 13:10:46.796695980 -0500
@@ -943,7 +943,7 @@ void cx231xx_uninit_bulk(struct cx231xx
if (dev->video_mode.bulk_ctl.transfer_buffer[i])
{
usb_free_coherent(dev->udev,urb->transfer_buffer_length,
-dev->video_mode.isoc_ctl.
+dev->video_mode.bulk_ctl.
transfer_buffer[i],
urb->transfer_dma);