diff options
author | Adrian Bunk <bunk@kernel.org> | 2008-09-03 16:12:25 -0400 |
---|---|---|
committer | Mauro Carvalho Chehab <mchehab@redhat.com> | 2008-09-03 17:37:53 -0400 |
commit | 8da9bae3292ea8aee803e7cda295877c361f0694 (patch) | |
tree | b50317e39edf3f0d92e704bdfd87b0ea58f78fb1 /drivers | |
parent | 9a0c04a1ee3b4df6a30ae6975e13c558908df400 (diff) |
V4L/DVB (8842): vivi_release(): fix use-after-free
video_device_release() does kfree(), which made the following printk()
doing a use-after-free.
printk() first and release then.
Reported-by: Adrian Bunk <bunk@kernel.org>
Signed-off-by: Adrian Bunk <bunk@kernel.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Diffstat (limited to 'drivers')
-rw-r--r-- | drivers/media/video/vivi.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/drivers/media/video/vivi.c b/drivers/media/video/vivi.c index f55d77db1558..8ba8daafd7ea 100644 --- a/drivers/media/video/vivi.c +++ b/drivers/media/video/vivi.c | |||
@@ -1021,13 +1021,13 @@ static int vivi_release(void) | |||
1021 | dev = list_entry(list, struct vivi_dev, vivi_devlist); | 1021 | dev = list_entry(list, struct vivi_dev, vivi_devlist); |
1022 | 1022 | ||
1023 | if (-1 != dev->vfd->minor) { | 1023 | if (-1 != dev->vfd->minor) { |
1024 | video_unregister_device(dev->vfd); | 1024 | printk(KERN_INFO "%s: unregistering /dev/video%d\n", |
1025 | printk(KERN_INFO "%s: /dev/video%d unregistered.\n", | ||
1026 | VIVI_MODULE_NAME, dev->vfd->minor); | 1025 | VIVI_MODULE_NAME, dev->vfd->minor); |
1026 | video_unregister_device(dev->vfd); | ||
1027 | } else { | 1027 | } else { |
1028 | video_device_release(dev->vfd); | 1028 | printk(KERN_INFO "%s: releasing /dev/video%d\n", |
1029 | printk(KERN_INFO "%s: /dev/video%d released.\n", | ||
1030 | VIVI_MODULE_NAME, dev->vfd->minor); | 1029 | VIVI_MODULE_NAME, dev->vfd->minor); |
1030 | video_device_release(dev->vfd); | ||
1031 | } | 1031 | } |
1032 | 1032 | ||
1033 | kfree(dev); | 1033 | kfree(dev); |