[PATCH] rcar-vin: fix null pointer dereference in rvin_group_get()

[Niklas Söderlund <niklas.soderlund+renesas@xxxxxxxxxxxx>]

Store the group pointer before disassociating the VIN from the group.

Fixes: 3bb4c3bc85bf77a7 ("media: rcar-vin: add group allocator functions")
Reported-by: Colin Ian King <colin.king@xxxxxxxxxxxxx>
Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@xxxxxxxxxxxx>
---
 drivers/media/platform/rcar-vin/rcar-core.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/drivers/media/platform/rcar-vin/rcar-core.c b/drivers/media/platform/rcar-vin/rcar-core.c
index 7bc2774a11232362..d3072e166a1ca24f 100644
--- a/drivers/media/platform/rcar-vin/rcar-core.c
+++ b/drivers/media/platform/rcar-vin/rcar-core.c
@@ -338,19 +338,21 @@ static int rvin_group_get(struct rvin_dev *vin)
 
 static void rvin_group_put(struct rvin_dev *vin)
 {
-	mutex_lock(&vin->group->lock);
+	struct rvin_group *group = vin->group;
+
+	mutex_lock(&group->lock);
 
 	vin->group = NULL;
 	vin->v4l2_dev.mdev = NULL;
 
-	if (WARN_ON(vin->group->vin[vin->id] != vin))
+	if (WARN_ON(group->vin[vin->id] != vin))
 		goto out;
 
-	vin->group->vin[vin->id] = NULL;
+	group->vin[vin->id] = NULL;
 out:
-	mutex_unlock(&vin->group->lock);
+	mutex_unlock(&group->lock);
 
-	kref_put(&vin->group->refcount, rvin_group_release);
+	kref_put(&group->refcount, rvin_group_release);
 }
 
 /* -----------------------------------------------------------------------------
-- 
2.17.0