diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2017-09-22 16:48:41 +0300 |
|---|---|---|
| committer | Mauro Carvalho Chehab <mchehab@s-opensource.com> | 2017-12-08 18:06:46 +0300 |
| commit | 6e298d58473520a806d59b7aa51dcb194d1a1b03 (patch) | |
| tree | 6a76dff03c1d938926aa62a7e9b65a7ce324ea38 /drivers/media/usb/stkwebcam | |
| parent | c0f71bbb810237a38734607ca4599632f7f5d47f (diff) | |
| download | linux-6e298d58473520a806d59b7aa51dcb194d1a1b03.tar.xz | |
media: stk-webcam: Fix use after free on disconnect
We free the stk_camera device too early. It's allocate first in probe
and it should be freed last in stk_camera_disconnect().
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Diffstat (limited to 'drivers/media/usb/stkwebcam')
| -rw-r--r-- | drivers/media/usb/stkwebcam/stk-webcam.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/media/usb/stkwebcam/stk-webcam.c b/drivers/media/usb/stkwebcam/stk-webcam.c index c0bba773db25..e748c976d967 100644 --- a/drivers/media/usb/stkwebcam/stk-webcam.c +++ b/drivers/media/usb/stkwebcam/stk-webcam.c @@ -1241,7 +1241,6 @@ static void stk_v4l_dev_release(struct video_device *vd) if (dev->sio_bufs != NULL || dev->isobufs != NULL) pr_err("We are leaking memory\n"); usb_put_intf(dev->interface); - kfree(dev); } static const struct video_device stk_v4l_data = { @@ -1391,6 +1390,7 @@ static void stk_camera_disconnect(struct usb_interface *interface) video_unregister_device(&dev->vdev); v4l2_ctrl_handler_free(&dev->hdl); v4l2_device_unregister(&dev->v4l2_dev); + kfree(dev); } #ifdef CONFIG_PM |