[PATCH 2/3] media: dvb-usb: dib0700: fix null-ptr-deref in dib0700_disconnect

From: Michael Chapman

Date: Thu Jul 16 2026 - 01:09:26 EST


dib0700_disconnect() may be called before driver-specific state has been
attached to the USB device.

Signed-off-by: Michael Chapman <mike@xxxxxxxxxxxxxxxxx>
---
drivers/media/usb/dvb-usb/dib0700_core.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/media/usb/dvb-usb/dib0700_core.c b/drivers/media/usb/dvb-usb/dib0700_core.c
index 1caabb51ea..2d281a2f45 100644
--- a/drivers/media/usb/dvb-usb/dib0700_core.c
+++ b/drivers/media/usb/dvb-usb/dib0700_core.c
@@ -911,9 +911,15 @@ static int dib0700_probe(struct usb_interface *intf,
static void dib0700_disconnect(struct usb_interface *intf)
{
struct dvb_usb_device *d = usb_get_intfdata(intf);
- struct dib0700_state *st = d->priv;
+ struct dib0700_state *st;
struct i2c_client *client;

+ if (!d)
+ goto exit;
+ st = d->priv;
+ if (!st)
+ goto exit;
+
/* remove I2C client for tuner */
client = st->i2c_client_tuner;
if (client) {
@@ -928,6 +934,7 @@ static void dib0700_disconnect(struct usb_interface *intf)
i2c_unregister_device(client);
}

+exit:
dvb_usb_device_exit(intf);
}

--
2.55.0