From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S934104AbdKGVSy (ORCPT ); Tue, 7 Nov 2017 16:18:54 -0500 Received: from gateway20.websitewelcome.com ([192.185.46.107]:40163 "EHLO gateway20.websitewelcome.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932422AbdKGVSx (ORCPT ); Tue, 7 Nov 2017 16:18:53 -0500 Date: Tue, 7 Nov 2017 15:18:50 -0600 From: "Gustavo A. R. Silva" To: Andrey Konovalov , Mauro Carvalho Chehab , LKML Cc: Dmitry Vyukov , Kostya Serebryany , syzkaller , "Gustavo A. R. Silva" Subject: Re: usb/media/em28xx: use-after-free in em28xx_dvb_fini Message-ID: <20171107211850.GA17663@embeddedor.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.24 (2015-08-30) X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - gator4166.hostgator.com X-AntiAbuse: Original Domain - vger.kernel.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - embeddedor.com X-BWhitelist: no X-Source-IP: 189.175.248.21 X-Source-L: No X-Exim-ID: 1eCBGl-000DFS-Rm X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: (embeddedor) [189.175.248.21]:58318 X-Source-Auth: garsilva@embeddedor.com X-Email-Count: 3 X-Source-Cap: Z3V6aWRpbmU7Z3V6aWRpbmU7Z2F0b3I0MTY2Lmhvc3RnYXRvci5jb20= X-Local-Domain: yes Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Hi Andrey, Could you please try this patch? Thank you Gustavo A. R. Silva --- drivers/media/usb/em28xx/em28xx-dvb.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/media/usb/em28xx/em28xx-dvb.c b/drivers/media/usb/em28xx/em28xx-dvb.c index 4a7db62..fc3fb92 100644 --- a/drivers/media/usb/em28xx/em28xx-dvb.c +++ b/drivers/media/usb/em28xx/em28xx-dvb.c @@ -2073,6 +2073,9 @@ static int em28xx_dvb_fini(struct em28xx *dev) struct em28xx_dvb *dvb; struct i2c_client *client; + if (!dev) + return 0; + if (dev->is_audio_only) { /* Shouldn't initialize IR for this interface */ return 0; -- 2.7.4