diff options
| author | Dan Carpenter | 2017-09-22 15:48:41 +0200 |
|---|---|---|
| committer | Mauro Carvalho Chehab | 2017-12-08 16:06:46 +0100 |
| commit | 6e298d58473520a806d59b7aa51dcb194d1a1b03 (patch) | |
| tree | 6a76dff03c1d938926aa62a7e9b65a7ce324ea38 /drivers/media/usb | |
| parent | media: hdpvr: Fix an error handling path in hdpvr_probe() (diff) | |
| download | kernel-qcow2-linux-6e298d58473520a806d59b7aa51dcb194d1a1b03.tar.gz kernel-qcow2-linux-6e298d58473520a806d59b7aa51dcb194d1a1b03.tar.xz kernel-qcow2-linux-6e298d58473520a806d59b7aa51dcb194d1a1b03.zip | |
media: stk-webcam: Fix use after free on disconnect
We free the stk_camera device too early. It's allocate first in probe
and it should be freed last in stk_camera_disconnect().
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Diffstat (limited to 'drivers/media/usb')
| -rw-r--r-- | drivers/media/usb/stkwebcam/stk-webcam.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/media/usb/stkwebcam/stk-webcam.c b/drivers/media/usb/stkwebcam/stk-webcam.c index c0bba773db25..e748c976d967 100644 --- a/drivers/media/usb/stkwebcam/stk-webcam.c +++ b/drivers/media/usb/stkwebcam/stk-webcam.c @@ -1241,7 +1241,6 @@ static void stk_v4l_dev_release(struct video_device *vd) if (dev->sio_bufs != NULL || dev->isobufs != NULL) pr_err("We are leaking memory\n"); usb_put_intf(dev->interface); - kfree(dev); } static const struct video_device stk_v4l_data = { @@ -1391,6 +1390,7 @@ static void stk_camera_disconnect(struct usb_interface *interface) video_unregister_device(&dev->vdev); v4l2_ctrl_handler_free(&dev->hdl); v4l2_device_unregister(&dev->v4l2_dev); + kfree(dev); } #ifdef CONFIG_PM |