diff options
| author | Dan Carpenter <error27@gmail.com> | 2010-12-06 10:02:55 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2010-12-07 03:09:45 +0300 |
| commit | 6b74705e15d5c87181008f1ac984df7faaad55c9 (patch) | |
| tree | 33cc1f638feaf9983a56a9ce77a3b25cfa036e8b | |
| parent | cd0b0ebfbe134b9c98fa8e628732b0e41b2cb48c (diff) | |
| download | linux-6b74705e15d5c87181008f1ac984df7faaad55c9.tar.xz | |
Staging: Beceem: use after free in bcm_exit()
We can't call class_destroy() until after the driver has been deregistered.
It leads to a NULL deref on module unload.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| -rw-r--r-- | drivers/staging/bcm/InterfaceInit.c | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/drivers/staging/bcm/InterfaceInit.c b/drivers/staging/bcm/InterfaceInit.c index dd829409a8c8..b4d22562d060 100644 --- a/drivers/staging/bcm/InterfaceInit.c +++ b/drivers/staging/bcm/InterfaceInit.c @@ -658,9 +658,8 @@ static __init int bcm_init(void) static __exit void bcm_exit(void) { - class_destroy(bcm_class); - usb_deregister(&usbbcm_driver); + class_destroy(bcm_class); } module_init(bcm_init); |