tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
fork atom

media: pci: cx23885: fix error handling for cx23885 ATSC boards

After having been assigned to NULL value at cx23885-dvb.c:1202,
pointer '0' is dereferenced at cx23885-dvb.c:2469.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Signed-off-by: Nikolay Burykin <burikin@ivk.ru>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

authored by

Nikolay Burykin and committed by
Mauro Carvalho Chehab 4aaa96b5 92cbf865

-12
-12
drivers/media/pci/cx23885/cx23885-dvb.c
··· 2459 2459 request_module("%s", info.type); 2460 2460 client_tuner = i2c_new_client_device(&dev->i2c_bus[1].i2c_adap, &info); 2461 2461 if (!i2c_client_has_driver(client_tuner)) { 2462 - module_put(client_demod->dev.driver->owner); 2463 - i2c_unregister_device(client_demod); 2464 - port->i2c_client_demod = NULL; 2465 2462 goto frontend_detach; 2466 2463 } 2467 2464 if (!try_module_get(client_tuner->dev.driver->owner)) { 2468 2465 i2c_unregister_device(client_tuner); 2469 - module_put(client_demod->dev.driver->owner); 2470 - i2c_unregister_device(client_demod); 2471 - port->i2c_client_demod = NULL; 2472 2466 goto frontend_detach; 2473 2467 } 2474 2468 port->i2c_client_tuner = client_tuner; ··· 2499 2505 request_module("%s", info.type); 2500 2506 client_tuner = i2c_new_client_device(&dev->i2c_bus[1].i2c_adap, &info); 2501 2507 if (!i2c_client_has_driver(client_tuner)) { 2502 - module_put(client_demod->dev.driver->owner); 2503 - i2c_unregister_device(client_demod); 2504 - port->i2c_client_demod = NULL; 2505 2508 goto frontend_detach; 2506 2509 } 2507 2510 if (!try_module_get(client_tuner->dev.driver->owner)) { 2508 2511 i2c_unregister_device(client_tuner); 2509 - module_put(client_demod->dev.driver->owner); 2510 - i2c_unregister_device(client_demod); 2511 - port->i2c_client_demod = NULL; 2512 2512 goto frontend_detach; 2513 2513 } 2514 2514 port->i2c_client_tuner = client_tuner;