bt878_probe() maps the device register window and then immediately clears
the interrupt mask through btwrite(). If ioremap() fails, the register
write dereferences a NULL mapping.

Check the mapping before touching the registers, and unmap it again on
later probe failures after the IRQ or DMA buffer allocation paths fail.

Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
---
 drivers/media/pci/bt8xx/bt878.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/media/pci/bt8xx/bt878.c b/drivers/media/pci/bt8xx/bt878.c
index 62a6c4a80..245a5f0ef 100644
--- a/drivers/media/pci/bt8xx/bt878.c
+++ b/drivers/media/pci/bt8xx/bt878.c
@@ -445,6 +445,10 @@ static int bt878_probe(struct pci_dev *dev, const struct pci_device_id *pci_id)
 	bt->bt878_mem = (unsigned char *) bt->bt878_adr;
 #else
 	bt->bt878_mem = ioremap(bt->bt878_adr, 0x1000);
+	if (!bt->bt878_mem) {
+		result = -ENOMEM;
+		goto fail1;
+	}
 #endif
 
 	/* clear interrupt mask */
@@ -486,6 +490,12 @@ static int bt878_probe(struct pci_dev *dev, const struct pci_device_id *pci_id)
       fail2:
 	free_irq(bt->irq, bt);
       fail1:
+#ifndef __sparc__
+	if (bt->bt878_mem) {
+		iounmap(bt->bt878_mem);
+		bt->bt878_mem = NULL;
+	}
+#endif
 	release_mem_region(pci_resource_start(bt->dev, 0),
 			   pci_resource_len(bt->dev, 0));
       fail0:
-- 
2.51.0