Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8da9bae3 authored by Adrian Bunk's avatar Adrian Bunk Committed by Mauro Carvalho Chehab
Browse files

V4L/DVB (8842): vivi_release(): fix use-after-free 



video_device_release() does kfree(), which made the following printk()
doing a use-after-free.

printk() first and release then.

Reported-by: default avatarAdrian Bunk <bunk@kernel.org>
Signed-off-by: default avatarAdrian Bunk <bunk@kernel.org>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@redhat.com>
parent 9a0c04a1

drivers/media/video/vivi.c

+4 −4
Original line number Original line Diff line number Diff line
@@ -1021,13 +1021,13 @@ static int vivi_release(void) 
		dev = list_entry(list, struct vivi_dev, vivi_devlist);

		dev = list_entry(list, struct vivi_dev, vivi_devlist);





		if (-1 != dev->vfd->minor) {

		if (-1 != dev->vfd->minor) {

			video_unregister_device(dev->vfd);

			printk(KERN_INFO "%s: unregistering /dev/video%d\n",

			printk(KERN_INFO "%s: /dev/video%d unregistered.\n",

				VIVI_MODULE_NAME, dev->vfd->minor);

				VIVI_MODULE_NAME, dev->vfd->minor);

			video_unregister_device(dev->vfd);

		} else {

		} else {

			video_device_release(dev->vfd);

			printk(KERN_INFO "%s: releasing /dev/video%d\n",

			printk(KERN_INFO "%s: /dev/video%d released.\n",

				VIVI_MODULE_NAME, dev->vfd->minor);

				VIVI_MODULE_NAME, dev->vfd->minor);

			video_device_release(dev->vfd);

		}

		}





		kfree(dev);

		kfree(dev);