[PATCH] gpib: agilent_82357a: fix null-ptr-deref in primary_address

[Giorgi Kobakhia]

The function agilent_82357a_primary_address initializes usb_dev with
interface_to_usbdev(a_priv->bus_interface) above the guarding if
(!a_priv->bus_interface) return -ENODEV; When the usb dongle is
unplugged, disconnect() sets bus_interface to NULL and the NULL
dereference is triggered.

Commit 8491e73a5223 ("staging: gpib: Fix Oops after disconnect in
agilent usb") fixes multiple NULL dereferences in other functions,
but this one is left out.

KASAN report for the left-out NULL deref:
 Oops: general protection fault, probably for non-canonical address ...
 KASAN: null-ptr-deref in range [0x0000000000000090-0x0000000000000097]
 RIP: 0010:agilent_82357a_primary_address (./include/linux/usb.h:752
  drivers/gpib/agilent_82357a/agilent_82357a.c:922)
 Call Trace:
  ibpad (drivers/gpib/common/iblib.c:466)
  ibioctl (drivers/gpib/common/gpib_os.c:1507
  drivers/gpib/common/gpib_os.c:675) __x64_sys_ioctl (fs/ioctl.c:51
  fs/ioctl.c:597 fs/ioctl.c:583 fs/ioctl.c:583) do_syscall_64
  (arch/x86/entry/syscall_64.c:61 arch/x86/entry/syscall_64.c:84)
  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
 Kernel panic - not syncing: Fatal exception

Remove the faulty assignment.

Fixes: fbae7090f30c ("staging: gpib: Update messaging and usb_device refs in agilent_usb")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Giorgi Kobakhia <gkobakhi@xxxxxxx>
---
 drivers/gpib/agilent_82357a/agilent_82357a.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpib/agilent_82357a/agilent_82357a.c b/drivers/gpib/agilent_82357a/agilent_82357a.c
index 2468a471d175..7abe5540ffc5 100644
--- a/drivers/gpib/agilent_82357a/agilent_82357a.c
+++ b/drivers/gpib/agilent_82357a/agilent_82357a.c
@@ -919,7 +919,7 @@ static unsigned int agilent_82357a_update_status(struct gpib_board *board,
 static int agilent_82357a_primary_address(struct gpib_board *board, unsigned int address)
 {
 	struct agilent_82357a_priv *a_priv = board->private_data;
-	struct usb_device *usb_dev = interface_to_usbdev(a_priv->bus_interface);
+	struct usb_device *usb_dev;
 	struct agilent_82357a_register_pairlet write;
 	int retval;
 
-- 
2.43.0