Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7c908fbb authored by Eric Sesterhenn's avatar Eric Sesterhenn Committed by Mauro Carvalho Chehab
Browse files

V4L/DVB (3790): Use after free in drivers/media/video/em28xx/em28xx-video.c 



In several places we use dev->devno right after we kfree() dev.  This fixes
coverity bug id #1065

Signed-off-by: default avatarEric Sesterhenn <snakebyte@gmx.de>
Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@infradead.org>
parent b37492be

drivers/media/video/em28xx/em28xx-video.c

+5 −5
Original line number Diff line number Diff line
@@ -1576,8 +1576,8 @@ static int em28xx_init_dev(struct em28xx **devhandle, struct usb_device *udev, 
	errCode = em28xx_config(dev);

	if (errCode) {

		em28xx_errdev("error configuring device\n");

		kfree(dev);

		em28xx_devused&=~(1<<dev->devno);

		kfree(dev);

		return -ENOMEM;

	}
@@ -1603,8 +1603,8 @@ static int em28xx_init_dev(struct em28xx **devhandle, struct usb_device *udev, 
	dev->vdev = video_device_alloc();

	if (NULL == dev->vdev) {

		em28xx_errdev("cannot allocate video_device.\n");

		kfree(dev);

		em28xx_devused&=~(1<<dev->devno);

		kfree(dev);

		return -ENOMEM;

	}
@@ -1612,8 +1612,8 @@ static int em28xx_init_dev(struct em28xx **devhandle, struct usb_device *udev, 
	if (NULL == dev->vbi_dev) {

		em28xx_errdev("cannot allocate video_device.\n");

		kfree(dev->vdev);

		kfree(dev);

		em28xx_devused&=~(1<<dev->devno);

		kfree(dev);

		return -ENOMEM;

	}
@@ -1650,8 +1650,8 @@ static int em28xx_init_dev(struct em28xx **devhandle, struct usb_device *udev, 
		mutex_unlock(&dev->lock);

		list_del(&dev->devlist);

		video_device_release(dev->vdev);

		kfree(dev);

		em28xx_devused&=~(1<<dev->devno);

		kfree(dev);

		return -ENODEV;

	}
@@ -1662,8 +1662,8 @@ static int em28xx_init_dev(struct em28xx **devhandle, struct usb_device *udev, 
		list_del(&dev->devlist);

		video_device_release(dev->vbi_dev);

		video_device_release(dev->vdev);

		kfree(dev);

		em28xx_devused&=~(1<<dev->devno);

		kfree(dev);

		return -ENODEV;

	} else {

		printk("registered VBI\n");