On Tue Sep 15 20:45:34 2026 -0700, Xiang Mei wrote:
> go7007_register_encoder() sets go->audio_enabled before calling
> go7007_snd_init() and discards its return value. go7007_snd_init()
> assigns go->snd_context only on success, so a failed ALSA setup leaves
> audio_enabled set with snd_context still NULL. The disconnect path tests
> audio_enabled and calls go7007_snd_remove(), which dereferences
> snd_context unconditionally.
>
> go7007_snd_init() returns -ENODEV once its never-decremented static card
> counter reaches SNDRV_CARDS, so SNDRV_CARDS attach/detach cycles arm the
> next attach; no memory pressure is needed.
>
> Set go->audio_enabled only once go7007_snd_init() has succeeded.
>
> Oops: general protection fault, probably for non-canonical address ...
> KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
> Workqueue: usb_hub_wq hub_event
> RIP: 0010:go7007_snd_remove (drivers/media/usb/go7007/snd-go7007.c:273)
> Call Trace:
> go7007_usb_disconnect (drivers/media/usb/go7007/go7007-usb.c:1336)
> usb_unbind_interface (drivers/usb/core/driver.c:461)
> device_remove (drivers/base/dd.c:618)
> device_release_driver_internal (drivers/base/dd.c:1349)
> bus_remove_device (drivers/base/bus.c:664)
> device_del (drivers/base/core.c:3965)
> usb_disable_device (drivers/usb/core/message.c:1478)
> usb_disconnect
> hub_event (drivers/usb/core/hub.c:5966)
> process_one_work (kernel/workqueue.c:3396)
> worker_thread (kernel/workqueue.c:3560)
> kthread (kernel/kthread.c:436)
> ret_from_fork (arch/x86/kernel/process.c:158)
> ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
> Kernel panic - not syncing: Fatal exception
>
> Cc: [email protected]
> Fixes: 866b8695d67e ("Staging: add the go7007 video driver")
> Assisted-by: LLM
> Signed-off-by: Xiang Mei <[email protected]>
> Signed-off-by: Hans Verkuil <[email protected]>
Patch committed.
Thanks,
Hans Verkuil
drivers/media/usb/go7007/go7007-driver.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
---
diff --git a/drivers/media/usb/go7007/go7007-driver.c
b/drivers/media/usb/go7007/go7007-driver.c
index 453ab5c3aa03..7db2440886b0 100644
--- a/drivers/media/usb/go7007/go7007-driver.c
+++ b/drivers/media/usb/go7007/go7007-driver.c
@@ -306,10 +306,9 @@ int go7007_register_encoder(struct go7007 *go, unsigned
num_i2c_devs)
if (ret < 0)
goto err_free_controls;
- if (go->board_info->flags & GO7007_BOARD_HAS_AUDIO) {
+ if ((go->board_info->flags & GO7007_BOARD_HAS_AUDIO) &&
+ go7007_snd_init(go) == 0)
go->audio_enabled = 1;
- go7007_snd_init(go);
- }
return 0;
err_free_controls:
_______________________________________________
linuxtv-commits mailing list -- [email protected]
To unsubscribe send an email to [email protected]
