Browse Source

V4L/DVB (8842): vivi_release(): fix use-after-free

video_device_release() does kfree(), which made the following printk()
doing a use-after-free.

printk() first and release then.

Reported-by: Adrian Bunk <bunk@kernel.org>
Signed-off-by: Adrian Bunk <bunk@kernel.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Adrian Bunk 16 years ago
parent
commit
8da9bae329
1 changed files with 4 additions and 4 deletions
  1. 4 4
      drivers/media/video/vivi.c

+ 4 - 4
drivers/media/video/vivi.c

@@ -1021,13 +1021,13 @@ static int vivi_release(void)
 		dev = list_entry(list, struct vivi_dev, vivi_devlist);
 		dev = list_entry(list, struct vivi_dev, vivi_devlist);
 
 
 		if (-1 != dev->vfd->minor) {
 		if (-1 != dev->vfd->minor) {
-			video_unregister_device(dev->vfd);
-			printk(KERN_INFO "%s: /dev/video%d unregistered.\n",
+			printk(KERN_INFO "%s: unregistering /dev/video%d\n",
 				VIVI_MODULE_NAME, dev->vfd->minor);
 				VIVI_MODULE_NAME, dev->vfd->minor);
+			video_unregister_device(dev->vfd);
 		} else {
 		} else {
-			video_device_release(dev->vfd);
-			printk(KERN_INFO "%s: /dev/video%d released.\n",
+			printk(KERN_INFO "%s: releasing /dev/video%d\n",
 				VIVI_MODULE_NAME, dev->vfd->minor);
 				VIVI_MODULE_NAME, dev->vfd->minor);
+			video_device_release(dev->vfd);
 		}
 		}
 
 
 		kfree(dev);
 		kfree(dev);