Commit 16cedd99 authored by Niklas Söderlund's avatar Niklas Söderlund Committed by Mauro Carvalho Chehab

media: rcar-vin: fix null pointer dereference in rvin_group_get()

Store the group pointer before disassociating the VIN from the group.

Fixes: 3bb4c3bc ("media: rcar-vin: add group allocator functions")
Reported-by: default avatarColin Ian King <colin.king@canonical.com>
Signed-off-by: default avatarNiklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
Reviewed-by: default avatarSimon Horman <horms+renesas@verge.net.au>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab+samsung@kernel.org>
parent ec2b0d04
...@@ -338,19 +338,21 @@ static int rvin_group_get(struct rvin_dev *vin) ...@@ -338,19 +338,21 @@ static int rvin_group_get(struct rvin_dev *vin)
static void rvin_group_put(struct rvin_dev *vin) static void rvin_group_put(struct rvin_dev *vin)
{ {
mutex_lock(&vin->group->lock); struct rvin_group *group = vin->group;
mutex_lock(&group->lock);
vin->group = NULL; vin->group = NULL;
vin->v4l2_dev.mdev = NULL; vin->v4l2_dev.mdev = NULL;
if (WARN_ON(vin->group->vin[vin->id] != vin)) if (WARN_ON(group->vin[vin->id] != vin))
goto out; goto out;
vin->group->vin[vin->id] = NULL; group->vin[vin->id] = NULL;
out: out:
mutex_unlock(&vin->group->lock); mutex_unlock(&group->lock);
kref_put(&vin->group->refcount, rvin_group_release); kref_put(&group->refcount, rvin_group_release);
} }
/* ----------------------------------------------------------------------------- /* -----------------------------------------------------------------------------
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment