Re: [PATCH] media: mxl111sf: fix null pointer dereference in mxl111sf_ctrl_msg

[syzbot <syzbot@syzkaller.appspotmail.com>]

> When mxl111sf_ctrl_msg() is called during early probe, state->d
> may not yet be initialized, causing a null pointer dereference in
> dvb_usbv2_generic_write() when it accesses d->usb_mutex.
>
> Add a null check for d before proceeding with the USB transfer.
>
> Fixes: d90b336f3f65 ("[media] mxl111sf: Fix driver to use heap allocate buffers for USB messages")
> Reported-by: syzbot+f9f333782a8f54509322@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=f9f333782a8f54509322
> Signed-off-by: Moksh Panicker <mokshpanicker.7@gmail.com>
> ---
>  drivers/media/usb/dvb-usb-v2/mxl111sf.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/drivers/media/usb/dvb-usb-v2/mxl111sf.c b/drivers/media/usb/dvb-usb-v2/mxl111sf.c
> index 870ac3c8b085..9908675c355e 100644
> --- a/drivers/media/usb/dvb-usb-v2/mxl111sf.c
> +++ b/drivers/media/usb/dvb-usb-v2/mxl111sf.c
> @@ -56,6 +56,9 @@ int mxl111sf_ctrl_msg(struct mxl111sf_state *state,
>  	int wo = (rbuf == NULL || rlen == 0); /* write-only */
>  	int ret;
>  
> +	if (!d)
> +		return -ENODEV;
> +
>  	if (1 + wlen > MXL_MAX_XFER_SIZE) {
>  		pr_warn("%s: len=%d is too big!\n", __func__, wlen);
>  		return -EOPNOTSUPP;
> -- 
> 2.34.1
>

I see the command but can't find the corresponding bug.
The email is sent to  syzbot+HASH@syzkaller.appspotmail.com address
but the HASH does not correspond to any known bug.
Please double check the address.