From nobody Sat Jul 25 16:19:20 2026 Received: from isildur.very.puzzling.org (isildur.very.puzzling.org [139.180.180.134]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5168322D7A9; Thu, 16 Jul 2026 05:09:20 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=139.180.180.134 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784178563; cv=none; b=M47aPNymhRKw2/rrILFr2xry1Fkxv3lXdJfXhowRn67P9LD/7OpHo9S2ca9ghlb6e/Fo9GrSK5JRrb09CxKt892Gmyr+Wzdh45BoHKPDgGXHxTaVICsY7khDmQmYqovvg6wXZCiHGDGag6/0rXCJbG0cD8CaZ+OWvUHPqsJtfd4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784178563; c=relaxed/simple; bh=C4a5D7HdzzDhCKeD/2KuOKQDuQ/Isc5/IITHMbgVXNg=; h=From:To:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=cQk9gzBll3T6NhoESVTWlclSdV+veyLl4996dRse1+fZrkuDvcP4Zcc9RZCT0TxPV7BPj/pbK940UkumH0mOb1Tu1ISJ4a17PI5rkGVVDmU1PtAagKn4/jlqqdU46R8+xLqBAYVrIzqagoLzX7j8IpGrnLTNcw+0OdN4UABIrzY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=very.puzzling.org; spf=pass smtp.mailfrom=very.puzzling.org; dkim=pass (2048-bit key) header.d=very.puzzling.org header.i=@very.puzzling.org header.b=i0T0923m; arc=none smtp.client-ip=139.180.180.134 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=very.puzzling.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=very.puzzling.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=very.puzzling.org header.i=@very.puzzling.org header.b="i0T0923m" Received: from beren.home (unknown [115.128.81.176]) by isildur.very.puzzling.org (Postfix) with ESMTPSA id 235ECADA; Thu, 16 Jul 2026 15:01:21 +1000 (AEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=very.puzzling.org; s=beta; t=1784178081; bh=LbhcNCP3Sg+yI3L6jjcVVSej40gTtvP7cyTZrhgsx9s=; h=From:To:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Transfer-Encoding:From:Reply-To:To:Cc:Subject: Date:Message-ID:Content-Type:Content-Transfer-Encoding: Content-Disposition:MIME-Version; b=i0T0923myo+h5kJPxaegeyndFvWdknZlpDjan7kAGqFw42TU6HFA+j4MCRTHX0ii1 yGQRSfgcyMen9eLd4R+uMHFh9yHfBAQc7BuEYJNN/FKmOcvVB7xwt5mZVCEyw5slTr /t+ZwYwqKfti4kgRYVQAOYFpmLCD3Y9bX21yvNaMwBpEKYDRRnzabrrr2W78PLXzci 7VnPjQzw7e4zAzIZC57L5A16a14QHXAYN37CXpNIe1u97DjyQZFSQWb+2yw5TX7Tza 1KyyXDNA4M241AlVD7y214Y9Eb97VKZid4Fdds5QQ7MDtgnT0nSWaBlKqCjvsShycr ozYrjcnsCEFsA== Received: by beren.home (Postfix, from userid 1000) id BA13741BFD; Thu, 16 Jul 2026 15:01:19 +1000 (AEST) From: Michael Chapman To: Michael Krufky , Mauro Carvalho Chehab , linux-media@vger.kernel.org, linux-kernel@vger.kernel.org, Michael Chapman Subject: [PATCH 1/3] media: dvb-usb: cxusb: fix null-ptr-deref in cxusb_disconnect Date: Thu, 16 Jul 2026 15:01:16 +1000 Message-ID: <20260716050118.30150-2-mike@very.puzzling.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260716050118.30150-1-mike@very.puzzling.org> References: <20260716050118.30150-1-mike@very.puzzling.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" cxusb_disconnect() may be called before driver-specific state has been attached to the USB device. Signed-off-by: Michael Chapman --- drivers/media/usb/dvb-usb/cxusb.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/drivers/media/usb/dvb-usb/cxusb.c b/drivers/media/usb/dvb-usb/= cxusb.c index d0501c1e81..c127bb574d 100644 --- a/drivers/media/usb/dvb-usb/cxusb.c +++ b/drivers/media/usb/dvb-usb/cxusb.c @@ -1668,9 +1668,15 @@ static int cxusb_probe(struct usb_interface *intf, static void cxusb_disconnect(struct usb_interface *intf) { struct dvb_usb_device *d =3D usb_get_intfdata(intf); - struct cxusb_state *st =3D d->priv; + struct cxusb_state *st; struct i2c_client *client; =20 + if (!d) + goto exit; + st =3D d->priv; + if (!st) + goto exit; + if (d->props.devices[0].warm_ids[0] =3D=3D &cxusb_table[MEDION_MD95700]) cxusb_medion_unregister_analog(d); =20 @@ -1688,6 +1694,7 @@ static void cxusb_disconnect(struct usb_interface *in= tf) i2c_unregister_device(client); } =20 +exit: dvb_usb_device_exit(intf); } =20 --=20 2.55.0 From nobody Sat Jul 25 16:19:20 2026 Received: from isildur.very.puzzling.org (isildur.very.puzzling.org [139.180.180.134]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 51836382380; Thu, 16 Jul 2026 05:09:20 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=139.180.180.134 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784178561; cv=none; b=jr00OQXWGtaiKNvylDEMw2szQ7h709BveKyNWfaVcpbbd1Xx7dbHT6zaMyzyRE6G16a/pHb92YCPx90WVelreMcOQPYKiHw2t0lWrOPyBhe4DH2E/ggzPvWDLYP1XgqNc5IqOao1/TLNAqX78sPMjTHbiOSEg7iqySOb6zrneIw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784178561; c=relaxed/simple; bh=6X7bZh8IXa7nX2yklw7mIwUS9JZ86Fh0UHbqiRvPe+o=; h=From:To:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=mKLyG20DVNkJYgJ9Lv0MSnSVmdhJOVNO87eBkCzmVCLvLpyoNInpdS5j59MZsGEqVf0VAhuaLhXtkLqQoIUc1n1RGpNLqpRp5okpXDDuOQVoM5OIMxK1Bh+lKVJsbRpA512PHIPKou57UPSfCZnDYTCDwjXDSE6IYfJKRAKu9Xo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=very.puzzling.org; spf=pass smtp.mailfrom=very.puzzling.org; dkim=pass (2048-bit key) header.d=very.puzzling.org header.i=@very.puzzling.org header.b=MgGOlyaO; arc=none smtp.client-ip=139.180.180.134 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=very.puzzling.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=very.puzzling.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=very.puzzling.org header.i=@very.puzzling.org header.b="MgGOlyaO" Received: from beren.home (unknown [115.128.81.176]) by isildur.very.puzzling.org (Postfix) with ESMTPSA id 1BD2EA4C; Thu, 16 Jul 2026 15:01:21 +1000 (AEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=very.puzzling.org; s=beta; t=1784178081; bh=UT+8l5jzRYIVaBbFouAzrbN8rTvujOKe+ORwEEuPfRo=; h=From:To:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Transfer-Encoding:From:Reply-To:To:Cc:Subject: Date:Message-ID:Content-Type:Content-Transfer-Encoding: Content-Disposition:MIME-Version; b=MgGOlyaOO762J74nY8Cd61FuXkMRvAhaFF1O+AdSwA8CRc1k0ECjVfjpyQbHNY1TW eTZSrBkHbJSg5A9J5CnP19HMKRahqsCt/iG6oQEuKTt+rqTsyCQ/1j5I/HP+0Q+mGw l64SkcUgzyxu9LzlJwCo0Faxn06mBjl6g6PgvkUN3CLJBjwTct1BBn9Pbdd/+5RbYg QSQy627XmY25hE58Z6Wum+1PYn1DKAFD7PLW7DSxXAusAUc+CFl7kWZ4HZk++d9ezX Hyen6cVU29bQZndQQ7GPerUgFNav+Zi0icJgDnQPz7j907Iy76f0sCkRaQKvuvv0pZ yZQbwCcEBG46Q== Received: by beren.home (Postfix, from userid 1000) id 9D4CA40080; Thu, 16 Jul 2026 15:01:19 +1000 (AEST) From: Michael Chapman To: Michael Krufky , Mauro Carvalho Chehab , linux-media@vger.kernel.org, linux-kernel@vger.kernel.org, Michael Chapman Subject: [PATCH 2/3] media: dvb-usb: dib0700: fix null-ptr-deref in dib0700_disconnect Date: Thu, 16 Jul 2026 15:01:17 +1000 Message-ID: <20260716050118.30150-3-mike@very.puzzling.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260716050118.30150-1-mike@very.puzzling.org> References: <20260716050118.30150-1-mike@very.puzzling.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" dib0700_disconnect() may be called before driver-specific state has been attached to the USB device. Signed-off-by: Michael Chapman --- drivers/media/usb/dvb-usb/dib0700_core.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/drivers/media/usb/dvb-usb/dib0700_core.c b/drivers/media/usb/d= vb-usb/dib0700_core.c index 1caabb51ea..2d281a2f45 100644 --- a/drivers/media/usb/dvb-usb/dib0700_core.c +++ b/drivers/media/usb/dvb-usb/dib0700_core.c @@ -911,9 +911,15 @@ static int dib0700_probe(struct usb_interface *intf, static void dib0700_disconnect(struct usb_interface *intf) { struct dvb_usb_device *d =3D usb_get_intfdata(intf); - struct dib0700_state *st =3D d->priv; + struct dib0700_state *st; struct i2c_client *client; =20 + if (!d) + goto exit; + st =3D d->priv; + if (!st) + goto exit; + /* remove I2C client for tuner */ client =3D st->i2c_client_tuner; if (client) { @@ -928,6 +934,7 @@ static void dib0700_disconnect(struct usb_interface *in= tf) i2c_unregister_device(client); } =20 +exit: dvb_usb_device_exit(intf); } =20 --=20 2.55.0 From nobody Sat Jul 25 16:19:20 2026 Received: from isildur.very.puzzling.org (isildur.very.puzzling.org [139.180.180.134]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5170F33CEB5; Thu, 16 Jul 2026 05:09:20 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=139.180.180.134 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784178561; cv=none; b=mBoAboQ4eXRuvBiaG1VDOAyL7OXwBd+l+YcTayr8UF2GftznfYLgSmYqnm1gMRBMIEIjQecw529BBlZqrmueMC2pMZeJqPl7qHtENOHUz9tSKy+YVHcX3IX2Z0Ce/Pde1yDmneAwKC7hsfz3qFghvJiJGScaf3WdGXm0ewMQE8s= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784178561; c=relaxed/simple; bh=M5UQkyAx7rYwV34fxoC/Y+LX5jVhpOQhf/6+1J8ziH0=; h=From:To:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=MTe6V94jVecKbLGDPtxHGu8dhVZmwGzzeJpkHbeTLIpvM01HW4EBCO0WnKUQBIMoipAxFsz11YbBOvfECauVyKXAgJTTVCG6loIGXLKo7heihwEe0kdrNrkmytAZQM40tyY2Z5Ir7iNNQh/SGcy7AsyaYdHnO8Pz9liUye1EsyU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=very.puzzling.org; spf=pass smtp.mailfrom=very.puzzling.org; dkim=pass (2048-bit key) header.d=very.puzzling.org header.i=@very.puzzling.org header.b=GI6Njn7o; arc=none smtp.client-ip=139.180.180.134 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=very.puzzling.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=very.puzzling.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=very.puzzling.org header.i=@very.puzzling.org header.b="GI6Njn7o" Received: from beren.home (unknown [115.128.81.176]) by isildur.very.puzzling.org (Postfix) with ESMTPSA id 207F8AD9; Thu, 16 Jul 2026 15:01:21 +1000 (AEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=very.puzzling.org; s=beta; t=1784178081; bh=KGfkywko2NUlL6xNJDzA4eSuOK7qSeMJRaNa9FIHG2Y=; h=From:To:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Transfer-Encoding:From:Reply-To:To:Cc:Subject: Date:Message-ID:Content-Type:Content-Transfer-Encoding: Content-Disposition:MIME-Version; b=GI6Njn7oHPw+10k5WghT5MgbudOdG7PFE+T2vWFrqQ/0B3oZZs/hzWcMi1GuOU3C0 k9P7mRDao9iBYSYPhnLcB2mHuWGkIJ9SDhe3SSt2pfuFb5fhTtcziOHAHW4NP7GIhY 6A4N2Eb2CutF4BL0wgiEWGnmN5JYGuyUm1UQ8/Z34UFzO3F4t/eY4mCkWjfFLz3pke 5T9K4QC6PdYg1xfbgK0wJXk2KzqG41p8OXiTtv8Aeo5+WKmZ/hfCjqYifKJ291O4ji XNNuLQj5sSX/yqCO1lxVQ8mwCGNs5+76lEDbG+WTGvraWR1rnOGJmb4YA4aXN0joam u8QJHq8nLbVBg== Received: by beren.home (Postfix, from userid 1000) id D4BD141BFC; Thu, 16 Jul 2026 15:01:19 +1000 (AEST) From: Michael Chapman To: Michael Krufky , Mauro Carvalho Chehab , linux-media@vger.kernel.org, linux-kernel@vger.kernel.org, Michael Chapman Subject: [PATCH 3/3] media: dvb-usb: dw2102: fix null-ptr-deref in dw2102_disconnect Date: Thu, 16 Jul 2026 15:01:18 +1000 Message-ID: <20260716050118.30150-4-mike@very.puzzling.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260716050118.30150-1-mike@very.puzzling.org> References: <20260716050118.30150-1-mike@very.puzzling.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" dw2102_disconnect() may be called before driver-specific state has been attached to the USB device. Signed-off-by: Michael Chapman --- drivers/media/usb/dvb-usb/dw2102.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/drivers/media/usb/dvb-usb/dw2102.c b/drivers/media/usb/dvb-usb= /dw2102.c index 4fecf2f965..bde7021a34 100644 --- a/drivers/media/usb/dvb-usb/dw2102.c +++ b/drivers/media/usb/dvb-usb/dw2102.c @@ -2618,9 +2618,15 @@ static int dw2102_probe(struct usb_interface *intf, static void dw2102_disconnect(struct usb_interface *intf) { struct dvb_usb_device *d =3D usb_get_intfdata(intf); - struct dw2102_state *st =3D d->priv; + struct dw2102_state *st; struct i2c_client *client; =20 + if (!d) + goto exit; + st =3D d->priv; + if (!st) + goto exit; + /* remove I2C client for tuner */ client =3D st->i2c_client_tuner; if (client) { @@ -2635,6 +2641,7 @@ static void dw2102_disconnect(struct usb_interface *i= ntf) i2c_unregister_device(client); } =20 +exit: dvb_usb_device_exit(intf); } =20 --=20 2.55.0