media: rcar-vin: fix null pointer dereference in rvin_group_get()

Store the group pointer before disassociating the VIN from the group.

Fixes: 3bb4c3bc85bf77a7 ("media: rcar-vin: add group allocator functions")

Reported-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>

diff --git a/drivers/media/platform/rcar-vin/rcar-core.c b/drivers/media/platform/rcar-vin/rcar-core.c
index 55b745ac86a5884d71839897cdc9df0b8b35d856..51e6694c494658146a35af6fd94274856fb8b715 100644 (file)
--- a/drivers/media/platform/rcar-vin/rcar-core.c
+++ b/drivers/media/platform/rcar-vin/rcar-core.c
@@ -338,19 +338,21 @@ err_group:
 
 static void rvin_group_put(struct rvin_dev *vin)
 {
-       mutex_lock(&vin->group->lock);
+       struct rvin_group *group = vin->group;
+
+       mutex_lock(&group->lock);
 
        vin->group = NULL;
        vin->v4l2_dev.mdev = NULL;
 
-       if (WARN_ON(vin->group->vin[vin->id] != vin))
+       if (WARN_ON(group->vin[vin->id] != vin))
                goto out;
 
-       vin->group->vin[vin->id] = NULL;
+       group->vin[vin->id] = NULL;
 out:
-       mutex_unlock(&vin->group->lock);
+       mutex_unlock(&group->lock);
 
-       kref_put(&vin->group->refcount, rvin_group_release);
+       kref_put(&group->refcount, rvin_group_release);
 }
 
 /* -----------------------------------------------------------------------------