[PATCH 1/2] media: gspca: konica: skip button release after input disconnect

[Wang Xiong]

gspca_disconnect() clears input_dev and unregisters the input device
after killing the transfer URBs.  An open video file can outlive that
disconnect, and its final close can still call sd_stopN().

If the snapshot button was pressed when the device was disconnected,
sd_stopN() passes the cleared pointer to input_report_key().  An
archived KASAN report shows a NULL read in input_event() from this
Konica stop callback.

Report the release only while an input device is registered.  Clear
snapshot_pressed in either case so the state does not survive the
stopped stream.  This addresses the input event access; the separate
USB parent lifetime problem is not changed here.

Tool disclosure: OpenAI Codex assisted with static analysis, the code
change and this message.  It was asked to check archived Konica USB
disconnect reports and prepare a minimal lifecycle fix.

Signed-off-by: Wang Xiong <20221010117@xxxxxxxxxxxxxxx>
---
 drivers/media/usb/gspca/konica.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/media/usb/gspca/konica.c b/drivers/media/usb/gspca/konica.c
index 53db9a289..017266d73 100644
--- a/drivers/media/usb/gspca/konica.c
+++ b/drivers/media/usb/gspca/konica.c
@@ -242,11 +242,11 @@ static void sd_stopN(struct gspca_dev *gspca_dev)
 #if IS_ENABLED(CONFIG_INPUT)
 	/* Don't keep the button in the pressed state "forever" if it was
 	   pressed when streaming is stopped */
-	if (sd->snapshot_pressed) {
+	if (sd->snapshot_pressed && gspca_dev->input_dev) {
 		input_report_key(gspca_dev->input_dev, KEY_CAMERA, 0);
 		input_sync(gspca_dev->input_dev);
-		sd->snapshot_pressed = 0;
 	}
+	sd->snapshot_pressed = 0;
 #endif
 }
 
-- 
2.47.3