V4L/DVB (8842): vivi_release(): fix use-after-free
authorAdrian Bunk <bunk@kernel.org>
Wed, 3 Sep 2008 20:12:25 +0000 (17:12 -0300)
committerMauro Carvalho Chehab <mchehab@redhat.com>
Wed, 3 Sep 2008 21:37:53 +0000 (18:37 -0300)
video_device_release() does kfree(), which made the following printk()
doing a use-after-free.

printk() first and release then.

Reported-by: Adrian Bunk <bunk@kernel.org>
Signed-off-by: Adrian Bunk <bunk@kernel.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
drivers/media/video/vivi.c

index f55d77db1558f80d8540ff38181bd3817ef92b07..8ba8daafd7ea2a3a2dff574b535a2908128b8d8b 100644 (file)
@@ -1021,13 +1021,13 @@ static int vivi_release(void)
                dev = list_entry(list, struct vivi_dev, vivi_devlist);
 
                if (-1 != dev->vfd->minor) {
-                       video_unregister_device(dev->vfd);
-                       printk(KERN_INFO "%s: /dev/video%d unregistered.\n",
+                       printk(KERN_INFO "%s: unregistering /dev/video%d\n",
                                VIVI_MODULE_NAME, dev->vfd->minor);
+                       video_unregister_device(dev->vfd);
                } else {
-                       video_device_release(dev->vfd);
-                       printk(KERN_INFO "%s: /dev/video%d released.\n",
+                       printk(KERN_INFO "%s: releasing /dev/video%d\n",
                                VIVI_MODULE_NAME, dev->vfd->minor);
+                       video_device_release(dev->vfd);
                }
 
                kfree(dev);