From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org,
syzbot+357d86bcb4cca1a2f572@syzkaller.appspotmail.com,
Sean Young <sean@mess.org>,
Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Subject: [PATCH 4.14 11/25] media: au0828: fix null dereference in error path
Date: Fri, 2 Aug 2019 11:39:43 +0200 [thread overview]
Message-ID: <20190802092103.210012158@linuxfoundation.org> (raw)
In-Reply-To: <20190802092058.428079740@linuxfoundation.org>
From: Sean Young <sean@mess.org>
commit 6d0d1ff9ff21fbb06b867c13a1d41ce8ddcd8230 upstream.
au0828_usb_disconnect() gets the au0828_dev struct via usb_get_intfdata,
so it needs to set up for the error paths.
Reported-by: syzbot+357d86bcb4cca1a2f572@syzkaller.appspotmail.com
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/au0828/au0828-core.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
--- a/drivers/media/usb/au0828/au0828-core.c
+++ b/drivers/media/usb/au0828/au0828-core.c
@@ -623,6 +623,12 @@ static int au0828_usb_probe(struct usb_i
/* Setup */
au0828_card_setup(dev);
+ /*
+ * Store the pointer to the au0828_dev so it can be accessed in
+ * au0828_usb_disconnect
+ */
+ usb_set_intfdata(interface, dev);
+
/* Analog TV */
retval = au0828_analog_register(dev, interface);
if (retval) {
@@ -641,12 +647,6 @@ static int au0828_usb_probe(struct usb_i
/* Remote controller */
au0828_rc_register(dev);
- /*
- * Store the pointer to the au0828_dev so it can be accessed in
- * au0828_usb_disconnect
- */
- usb_set_intfdata(interface, dev);
-
pr_info("Registered device AU0828 [%s]\n",
dev->board.name == NULL ? "Unset" : dev->board.name);
next prev parent reply other threads:[~2019-08-02 9:53 UTC|newest]
Thread overview: 33+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-08-02 9:39 [PATCH 4.14 00/25] 4.14.136-stable review Greg Kroah-Hartman
2019-08-02 9:39 ` [PATCH 4.14 01/25] VSOCK: use TCP state constants for sk_state Greg Kroah-Hartman
2019-08-02 9:39 ` [PATCH 4.14 02/25] vsock: correct removal of socket from the list Greg Kroah-Hartman
2019-08-02 9:39 ` [PATCH 4.14 03/25] NFS: Fix dentry revalidation on NFSv4 lookup Greg Kroah-Hartman
2019-08-02 9:39 ` [PATCH 4.14 04/25] NFS: Refactor nfs_lookup_revalidate() Greg Kroah-Hartman
2019-08-02 9:39 ` [PATCH 4.14 05/25] NFSv4: Fix lookup revalidate of regular files Greg Kroah-Hartman
2019-08-02 9:39 ` [PATCH 4.14 06/25] arm64: dts: marvell: Fix A37xx UART0 register size Greg Kroah-Hartman
2019-08-02 9:39 ` [PATCH 4.14 07/25] i2c: qup: fixed releasing dma without flush operation completion Greg Kroah-Hartman
2019-08-02 9:39 ` [PATCH 4.14 08/25] arm64: compat: Provide definition for COMPAT_SIGMINSTKSZ Greg Kroah-Hartman
2019-08-02 9:39 ` [PATCH 4.14 09/25] binder: fix possible UAF when freeing buffer Greg Kroah-Hartman
2019-08-02 9:39 ` [PATCH 4.14 10/25] ISDN: hfcsusb: checking idx of ep configuration Greg Kroah-Hartman
2019-08-02 9:39 ` Greg Kroah-Hartman [this message]
2019-08-02 9:39 ` [PATCH 4.14 12/25] ath10k: Change the warning message string Greg Kroah-Hartman
2019-08-02 9:39 ` [PATCH 4.14 13/25] media: cpia2_usb: first wake up, then free in disconnect Greg Kroah-Hartman
2019-08-02 9:39 ` [PATCH 4.14 14/25] media: pvrusb2: use a different format for warnings Greg Kroah-Hartman
2019-08-02 9:39 ` [PATCH 4.14 15/25] NFS: Cleanup if nfs_match_client is interrupted Greg Kroah-Hartman
2019-08-02 9:39 ` [PATCH 4.14 16/25] media: radio-raremono: change devm_k*alloc to k*alloc Greg Kroah-Hartman
2019-08-02 9:39 ` [PATCH 4.14 17/25] iommu/vt-d: Dont queue_iova() if there is no flush queue Greg Kroah-Hartman
2019-08-02 9:39 ` Greg Kroah-Hartman
2019-08-02 9:39 ` [PATCH 4.14 18/25] iommu/iova: Fix compilation error with !CONFIG_IOMMU_IOVA Greg Kroah-Hartman
2019-08-02 9:39 ` [PATCH 4.14 19/25] hv_sock: Add support for delayed close Greg Kroah-Hartman
2019-08-02 9:39 ` [PATCH 4.14 20/25] Bluetooth: hci_uart: check for missing tty operations Greg Kroah-Hartman
2019-08-02 9:39 ` [PATCH 4.14 21/25] sched/fair: Dont free p->numa_faults with concurrent readers Greg Kroah-Hartman
2019-08-02 9:39 ` [PATCH 4.14 22/25] drivers/pps/pps.c: clear offset flags in PPS_SETPARAMS ioctl Greg Kroah-Hartman
2019-08-02 9:39 ` [PATCH 4.14 23/25] Fix allyesconfig output Greg Kroah-Hartman
2019-08-02 9:39 ` [PATCH 4.14 24/25] ceph: hold i_ceph_lock when removing caps for freeing inode Greg Kroah-Hartman
2019-08-02 9:39 ` [PATCH 4.14 25/25] sched/fair: Use RCU accessors consistently for ->numa_group Greg Kroah-Hartman
2019-08-02 15:37 ` Greg Kroah-Hartman
2019-08-02 13:59 ` [PATCH 4.14 00/25] 4.14.136-stable review Thierry Reding
2019-08-02 15:50 ` Greg Kroah-Hartman
2019-08-03 5:43 ` Naresh Kamboju
2019-08-02 23:20 ` shuah
2019-08-03 15:59 ` Guenter Roeck
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190802092103.210012158@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mchehab+samsung@kernel.org \
--cc=sean@mess.org \
--cc=stable@vger.kernel.org \
--cc=syzbot+357d86bcb4cca1a2f572@syzkaller.appspotmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.