media: si470x: Fix use-after-free in si470x_int_in_callback()

In the Linux kernel, the following vulnerability has been resolved:

media: si470x: Fix use-after-free in si470x_int_in_callback()

syzbot reported use-after-free in si470x_int_in_callback() [1]. This

indicates that urb->context, which contains struct si470x_device

object, is freed when si470x_int_in_callback() is called.

The cause of this issue is that si470x_int_in_callback() is called for

freed urb.

si470x_usb_driver_probe() calls si470x_start_usb(), which then calls

usb_submit_urb() and si470x_start(). If si470x_start_usb() fails,

si470x_usb_driver_probe() doesn't kill urb, but it just frees struct

si470x_device object, as depicted below:

si470x_usb_driver_probe()

...

si470x_start_usb()

...

usb_submit_urb()

retval = si470x_start()

return retval

if (retval < 0)

free struct si470x_device object, but don't kill urb

This patch fixes this issue by killing urb when si470x_start_usb()

fails and urb is submitted. If si470x_start_usb() fails and urb is

not submitted, i.e. submitting usb fails, it just frees struct

si470x_device object.