[PATCH] rcar-vin: fix null pointer dereference in rvin_group_get()

[Niklas Söderlund]

Store the group pointer before disassociating the VIN from the group.

Fixes: 3bb4c3bc85bf77a7 ("media: rcar-vin: add group allocator functions")
Reported-by: Colin Ian King <colin.k...@canonical.com>
Signed-off-by: Niklas Söderlund <niklas.soderlund+rene...@ragnatech.se>
---
 drivers/media/platform/rcar-vin/rcar-core.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/drivers/media/platform/rcar-vin/rcar-core.c 
b/drivers/media/platform/rcar-vin/rcar-core.c
index 7bc2774a11232362..d3072e166a1ca24f 100644
--- a/drivers/media/platform/rcar-vin/rcar-core.c
+++ b/drivers/media/platform/rcar-vin/rcar-core.c
@@ -338,19 +338,21 @@ static int rvin_group_get(struct rvin_dev *vin)
 
 static void rvin_group_put(struct rvin_dev *vin)
 {
-       mutex_lock(&vin->group->lock);
+       struct rvin_group *group = vin->group;
+
+       mutex_lock(&group->lock);
 
        vin->group = NULL;
        vin->v4l2_dev.mdev = NULL;
 
-       if (WARN_ON(vin->group->vin[vin->id] != vin))
+       if (WARN_ON(group->vin[vin->id] != vin))
                goto out;
 
-       vin->group->vin[vin->id] = NULL;
+       group->vin[vin->id] = NULL;
 out:
-       mutex_unlock(&vin->group->lock);
+       mutex_unlock(&group->lock);
 
-       kref_put(&vin->group->refcount, rvin_group_release);
+       kref_put(&group->refcount, rvin_group_release);
 }
 
 /* 
-----------------------------------------------------------------------------
-- 
2.17.0