diff options
| author | Dan Carpenter <error27@gmail.com> | 2011-06-17 14:25:09 +0400 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2011-07-05 21:22:50 +0400 |
| commit | 38d0cffefd3daaad6bc58a6212d16edeaa8ee1f0 (patch) | |
| tree | ef7a7e30bc428f952834b92a6e1babba557f19f2 /drivers/staging/easycap | |
| parent | 981aabb1482c79014b3bc1a61f0c87bdbceae41d (diff) | |
| download | linux-38d0cffefd3daaad6bc58a6212d16edeaa8ee1f0.tar.xz | |
Staging: easycap: use after free in easycap_delete()
The JOM() macro dereferences peasycap, so I moved the free down some
lines.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Acked-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'drivers/staging/easycap')
| -rw-r--r-- | drivers/staging/easycap/easycap_main.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/drivers/staging/easycap/easycap_main.c b/drivers/staging/easycap/easycap_main.c index 62e07f6a026c..84d4f77ef46b 100644 --- a/drivers/staging/easycap/easycap_main.c +++ b/drivers/staging/easycap/easycap_main.c @@ -913,8 +913,6 @@ static void easycap_delete(struct kref *pkref) allocation_audio_struct = peasycap->allocation_audio_struct; registered_audio = peasycap->registered_audio; - kfree(peasycap); - if (0 <= kd && DONGLE_MANY > kd) { if (mutex_lock_interruptible(&mutex_dongle)) { SAY("ERROR: cannot down mutex_dongle\n"); @@ -929,6 +927,9 @@ static void easycap_delete(struct kref *pkref) } else { SAY("ERROR: cannot purge dongle[].peasycap"); } + + kfree(peasycap); + /*---------------------------------------------------------------------------*/ SAY("%8i=video urbs after all deletions\n", allocation_video_urb); SAY("%8i=video pages after all deletions\n", allocation_video_page); |