From: Niklas Söderlund Date: Tue, 24 Apr 2018 23:45:06 +0000 (-0400) Subject: media: rcar-vin: fix null pointer dereference in rvin_group_get() X-Git-Tag: v4.18-rc1~107^2~206 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=16cedd99c64cc9f128a3e9bb0613980833b7f938;p=thirdparty%2Flinux.git media: rcar-vin: fix null pointer dereference in rvin_group_get() Store the group pointer before disassociating the VIN from the group. Fixes: 3bb4c3bc85bf77a7 ("media: rcar-vin: add group allocator functions") Reported-by: Colin Ian King Signed-off-by: Niklas Söderlund Reviewed-by: Simon Horman Signed-off-by: Mauro Carvalho Chehab --- diff --git a/drivers/media/platform/rcar-vin/rcar-core.c b/drivers/media/platform/rcar-vin/rcar-core.c index 55b745ac86a58..51e6694c49465 100644 --- a/drivers/media/platform/rcar-vin/rcar-core.c +++ b/drivers/media/platform/rcar-vin/rcar-core.c @@ -338,19 +338,21 @@ err_group: static void rvin_group_put(struct rvin_dev *vin) { - mutex_lock(&vin->group->lock); + struct rvin_group *group = vin->group; + + mutex_lock(&group->lock); vin->group = NULL; vin->v4l2_dev.mdev = NULL; - if (WARN_ON(vin->group->vin[vin->id] != vin)) + if (WARN_ON(group->vin[vin->id] != vin)) goto out; - vin->group->vin[vin->id] = NULL; + group->vin[vin->id] = NULL; out: - mutex_unlock(&vin->group->lock); + mutex_unlock(&group->lock); - kref_put(&vin->group->refcount, rvin_group_release); + kref_put(&group->refcount, rvin_group_release); } /* -----------------------------------------------------------------------------