From: Adrian Bunk Date: Wed, 3 Sep 2008 20:12:25 +0000 (-0300) Subject: V4L/DVB (8842): vivi_release(): fix use-after-free X-Git-Tag: v2.6.27-rc6~37^2~4^2~8 X-Git-Url: https://err.no/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=8da9bae3292ea8aee803e7cda295877c361f0694;p=linux-2.6 V4L/DVB (8842): vivi_release(): fix use-after-free video_device_release() does kfree(), which made the following printk() doing a use-after-free. printk() first and release then. Reported-by: Adrian Bunk Signed-off-by: Adrian Bunk Signed-off-by: Mauro Carvalho Chehab --- diff --git a/drivers/media/video/vivi.c b/drivers/media/video/vivi.c index f55d77db15..8ba8daafd7 100644 --- a/drivers/media/video/vivi.c +++ b/drivers/media/video/vivi.c @@ -1021,13 +1021,13 @@ static int vivi_release(void) dev = list_entry(list, struct vivi_dev, vivi_devlist); if (-1 != dev->vfd->minor) { - video_unregister_device(dev->vfd); - printk(KERN_INFO "%s: /dev/video%d unregistered.\n", + printk(KERN_INFO "%s: unregistering /dev/video%d\n", VIVI_MODULE_NAME, dev->vfd->minor); + video_unregister_device(dev->vfd); } else { - video_device_release(dev->vfd); - printk(KERN_INFO "%s: /dev/video%d released.\n", + printk(KERN_INFO "%s: releasing /dev/video%d\n", VIVI_MODULE_NAME, dev->vfd->minor); + video_device_release(dev->vfd); } kfree(dev);