diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2012-08-14 02:58:15 -0300 |
|---|---|---|
| committer | Mauro Carvalho Chehab <mchehab@redhat.com> | 2012-08-15 18:49:00 -0300 |
| commit | e36c92fd63bb4773e6f4bc38ecee11a609ded1cf (patch) | |
| tree | 3ed46009422b64c40d354acdc63cbca6646baa56 /drivers | |
| parent | 5359805193dc83e1aab2f8e230d57c649363c5c5 (diff) | |
| download | linux-e36c92fd63bb4773e6f4bc38ecee11a609ded1cf.tar.gz | |
[media] em28xx: use after free in em28xx_v4l2_close()
We need to move the unlock before the kfree(dev); Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/media/usb/em28xx/em28xx-video.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/media/usb/em28xx/em28xx-video.c b/drivers/media/usb/em28xx/em28xx-video.c index ecb23df7f16e..78d6ebd712b9 100644 --- a/drivers/media/usb/em28xx/em28xx-video.c +++ b/drivers/media/usb/em28xx/em28xx-video.c @@ -2264,9 +2264,9 @@ static int em28xx_v4l2_close(struct file *filp) if (dev->state & DEV_DISCONNECTED) { em28xx_release_resources(dev); kfree(dev->alt_max_pkt_size); + mutex_unlock(&dev->lock); kfree(dev); kfree(fh); - mutex_unlock(&dev->lock); return 0; } |