Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 38d0cffe authored by Dan Carpenter's avatar Dan Carpenter Committed by Greg Kroah-Hartman
Browse files

Staging: easycap: use after free in easycap_delete() 



The JOM() macro dereferences peasycap, so I moved the free down some
lines.

Signed-off-by: default avatarDan Carpenter <error27@gmail.com>
Acked-by: default avatarTomas Winkler <tomas.winkler@intel.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
parent 981aabb1

drivers/staging/easycap/easycap_main.c

+3 −2
Original line number Diff line number Diff line
@@ -913,8 +913,6 @@ static void easycap_delete(struct kref *pkref) 
	allocation_audio_struct = peasycap->allocation_audio_struct;

	registered_audio        = peasycap->registered_audio;



	kfree(peasycap);



	if (0 <= kd && DONGLE_MANY > kd) {

		if (mutex_lock_interruptible(&mutex_dongle)) {

			SAY("ERROR: cannot down mutex_dongle\n");
@@ -929,6 +927,9 @@ static void easycap_delete(struct kref *pkref) 
	} else {

		SAY("ERROR: cannot purge dongle[].peasycap");

	}



	kfree(peasycap);



/*---------------------------------------------------------------------------*/

	SAY("%8i=video urbs    after all deletions\n", allocation_video_urb);

	SAY("%8i=video pages   after all deletions\n", allocation_video_page);