Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f7d3edb0 authored by Sean Young's avatar Sean Young Committed by Greg Kroah-Hartman
Browse files

media: au0828: fix null dereference in error path 



commit 6d0d1ff9ff21fbb06b867c13a1d41ce8ddcd8230 upstream.

au0828_usb_disconnect() gets the au0828_dev struct via usb_get_intfdata,
so it needs to set up for the error paths.

Reported-by: default avatar <syzbot+357d86bcb4cca1a2f572@syzkaller.appspotmail.com>
Signed-off-by: default avatarSean Young <sean@mess.org>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent af34434a

drivers/media/usb/au0828/au0828-core.c

+6 −6
Original line number Diff line number Diff line
@@ -630,6 +630,12 @@ static int au0828_usb_probe(struct usb_interface *interface, 
	/* Setup */

	au0828_card_setup(dev);



	/*

	 * Store the pointer to the au0828_dev so it can be accessed in

	 * au0828_usb_disconnect

	 */

	usb_set_intfdata(interface, dev);



	/* Analog TV */

	retval = au0828_analog_register(dev, interface);

	if (retval) {
@@ -647,12 +653,6 @@ static int au0828_usb_probe(struct usb_interface *interface, 
	/* Remote controller */

	au0828_rc_register(dev);



	/*

	 * Store the pointer to the au0828_dev so it can be accessed in

	 * au0828_usb_disconnect

	 */

	usb_set_intfdata(interface, dev);



	pr_info("Registered device AU0828 [%s]\n",

		dev->board.name == NULL ? "Unset" : dev->board.name);