@@ -366,9 +366,6 @@ struct dvb_frontend *e4000_attach(struct dvb_frontend *fe,
priv->cfg = cfg;
priv->i2c = i2c;
- fe->tuner_priv = priv;
- memcpy(&fe->ops.tuner_ops, &e4000_tuner_ops,
- sizeof(struct dvb_tuner_ops));
/* check if the tuner is there */
ret = e4000_rd_reg(priv, 0x02, &chip_id);
@@ -389,6 +386,10 @@ struct dvb_frontend *e4000_attach(struct dvb_frontend *fe,
"%s: Elonics E4000 successfully identified\n",
KBUILD_MODNAME);
+ fe->tuner_priv = priv;
+ memcpy(&fe->ops.tuner_ops, &e4000_tuner_ops,
+ sizeof(struct dvb_tuner_ops));
+
if (fe->ops.i2c_gate_ctrl)
fe->ops.i2c_gate_ctrl(fe, 0);
Callbacks were set even attach failed. This leads calling .release() in error case and resulted crash. Reported-by: Oliver Schinagl <oliver@schinagl.nl> Signed-off-by: Antti Palosaari <crope@iki.fi> --- drivers/media/tuners/e4000.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)