From 8da9bae3292ea8aee803e7cda295877c361f0694 Mon Sep 17 00:00:00 2001
From: Adrian Bunk <bunk@kernel.org>
Date: Wed, 3 Sep 2008 17:12:25 -0300
Subject: [PATCH] V4L/DVB (8842): vivi_release(): fix use-after-free
video_device_release() does kfree(), which made the following printk()
doing a use-after-free.
printk() first and release then.
Reported-by: Adrian Bunk <bunk@kernel.org>
Signed-off-by: Adrian Bunk <bunk@kernel.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
---
drivers/media/video/vivi.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/media/video/vivi.c b/drivers/media/video/vivi.c
index f55d77db1558..8ba8daafd7ea 100644
--- a/drivers/media/video/vivi.c
+++ b/drivers/media/video/vivi.c
@@ -1021,13 +1021,13 @@ static int vivi_release(void)
dev = list_entry(list, struct vivi_dev, vivi_devlist);
if (-1 != dev->vfd->minor) {
+ printk(KERN_INFO "%s: unregistering /dev/video%d\n",
+ VIVI_MODULE_NAME, dev->vfd->minor);
video_unregister_device(dev->vfd);
- printk(KERN_INFO "%s: /dev/video%d unregistered.\n",
- VIVI_MODULE_NAME, dev->vfd->minor);
} else {
- video_device_release(dev->vfd);
- printk(KERN_INFO "%s: /dev/video%d released.\n",
+ printk(KERN_INFO "%s: releasing /dev/video%d\n",
VIVI_MODULE_NAME, dev->vfd->minor);
+ video_device_release(dev->vfd);
}
kfree(dev);