Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit eb83a517 authored by Mauro Carvalho Chehab's avatar Mauro Carvalho Chehab
Browse files

[media] media-entity: fix backlink removal on __media_entity_remove_link() 



The logic is testing if num_links==0 at the wrong place. Due to
that, a backlink may be kept without removal, causing KASAN
to complain about usage after free during either entity or
link removal.

Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@osg.samsung.com>
parent a9709e43

drivers/media/media-entity.c

+3 −3
Original line number Diff line number Diff line
@@ -662,13 +662,13 @@ static void __media_entity_remove_link(struct media_entity *entity, 
		if (link->source->entity == entity)

			remote->num_backlinks--;



		if (--remote->num_links == 0)

			break;



		/* Remove the remote link */

		list_del(&rlink->list);

		media_gobj_remove(&rlink->graph_obj);

		kfree(rlink);



		if (--remote->num_links == 0)

			break;

	}

	list_del(&link->list);

	media_gobj_remove(&link->graph_obj);