Commit e36c92fd authored Aug 14, 2012 by Dan Carpenter Committed by Mauro Carvalho Chehab Aug 15, 2012

[media] em28xx: use after free in em28xx_v4l2_close()



We need to move the unlock before the kfree(dev);

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

parent 53598051

drivers/media/usb/em28xx/em28xx-video.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -2264,9 +2264,9 @@ static int em28xx_v4l2_close(struct file *filp)
		if (dev->state & DEV_DISCONNECTED) {
		em28xx_release_resources(dev);
		kfree(dev->alt_max_pkt_size);
		mutex_unlock(&dev->lock);
		kfree(dev);
		kfree(fh);
		mutex_unlock(&dev->lock);
		return 0;
		}