diff options
author | Dan Carpenter <error27@gmail.com> | 2011-06-17 06:25:09 -0400 |
---|---|---|
committer | Greg Kroah-Hartman <gregkh@suse.de> | 2011-07-05 13:22:50 -0400 |
commit | 38d0cffefd3daaad6bc58a6212d16edeaa8ee1f0 (patch) | |
tree | ef7a7e30bc428f952834b92a6e1babba557f19f2 /drivers/staging/easycap | |
parent | 981aabb1482c79014b3bc1a61f0c87bdbceae41d (diff) |
Staging: easycap: use after free in easycap_delete()
The JOM() macro dereferences peasycap, so I moved the free down some
lines.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Acked-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'drivers/staging/easycap')
-rw-r--r-- | drivers/staging/easycap/easycap_main.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/drivers/staging/easycap/easycap_main.c b/drivers/staging/easycap/easycap_main.c index 62e07f6a026..84d4f77ef46 100644 --- a/drivers/staging/easycap/easycap_main.c +++ b/drivers/staging/easycap/easycap_main.c | |||
@@ -913,8 +913,6 @@ static void easycap_delete(struct kref *pkref) | |||
913 | allocation_audio_struct = peasycap->allocation_audio_struct; | 913 | allocation_audio_struct = peasycap->allocation_audio_struct; |
914 | registered_audio = peasycap->registered_audio; | 914 | registered_audio = peasycap->registered_audio; |
915 | 915 | ||
916 | kfree(peasycap); | ||
917 | |||
918 | if (0 <= kd && DONGLE_MANY > kd) { | 916 | if (0 <= kd && DONGLE_MANY > kd) { |
919 | if (mutex_lock_interruptible(&mutex_dongle)) { | 917 | if (mutex_lock_interruptible(&mutex_dongle)) { |
920 | SAY("ERROR: cannot down mutex_dongle\n"); | 918 | SAY("ERROR: cannot down mutex_dongle\n"); |
@@ -929,6 +927,9 @@ static void easycap_delete(struct kref *pkref) | |||
929 | } else { | 927 | } else { |
930 | SAY("ERROR: cannot purge dongle[].peasycap"); | 928 | SAY("ERROR: cannot purge dongle[].peasycap"); |
931 | } | 929 | } |
930 | |||
931 | kfree(peasycap); | ||
932 | |||
932 | /*---------------------------------------------------------------------------*/ | 933 | /*---------------------------------------------------------------------------*/ |
933 | SAY("%8i=video urbs after all deletions\n", allocation_video_urb); | 934 | SAY("%8i=video urbs after all deletions\n", allocation_video_urb); |
934 | SAY("%8i=video pages after all deletions\n", allocation_video_page); | 935 | SAY("%8i=video pages after all deletions\n", allocation_video_page); |