[PATCH 1/3] media: dvb-usb: cxusb: fix null-ptr-deref in cxusb_disconnect

From: Michael Chapman

Date: Thu Jul 16 2026 - 01:11:15 EST


cxusb_disconnect() may be called before driver-specific state has been
attached to the USB device.

Signed-off-by: Michael Chapman <mike@xxxxxxxxxxxxxxxxx>
---
drivers/media/usb/dvb-usb/cxusb.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/media/usb/dvb-usb/cxusb.c b/drivers/media/usb/dvb-usb/cxusb.c
index d0501c1e81..c127bb574d 100644
--- a/drivers/media/usb/dvb-usb/cxusb.c
+++ b/drivers/media/usb/dvb-usb/cxusb.c
@@ -1668,9 +1668,15 @@ static int cxusb_probe(struct usb_interface *intf,
static void cxusb_disconnect(struct usb_interface *intf)
{
struct dvb_usb_device *d = usb_get_intfdata(intf);
- struct cxusb_state *st = d->priv;
+ struct cxusb_state *st;
struct i2c_client *client;

+ if (!d)
+ goto exit;
+ st = d->priv;
+ if (!st)
+ goto exit;
+
if (d->props.devices[0].warm_ids[0] == &cxusb_table[MEDION_MD95700])
cxusb_medion_unregister_analog(d);

@@ -1688,6 +1694,7 @@ static void cxusb_disconnect(struct usb_interface *intf)
i2c_unregister_device(client);
}

+exit:
dvb_usb_device_exit(intf);
}

--
2.55.0