Commit d625bd72 authored by Andrew Morton's avatar Andrew Morton Committed by Linus Torvalds

[PATCH] v4l use-after-free fix

From: Greg KH <greg@kroah.com>

When working on converting the usb v4l drivers to the new v4l class
changes, I ran into this nasty bug.  Seems that the core was using a
structure after it had been freed.  The patch below fixes it.
parent de141c53
...@@ -349,9 +349,9 @@ void video_unregister_device(struct video_device *vfd) ...@@ -349,9 +349,9 @@ void video_unregister_device(struct video_device *vfd)
if(video_device[vfd->minor]!=vfd) if(video_device[vfd->minor]!=vfd)
panic("videodev: bad unregister"); panic("videodev: bad unregister");
class_device_unregister(&vfd->class_dev);
devfs_remove(vfd->devfs_name); devfs_remove(vfd->devfs_name);
video_device[vfd->minor]=NULL; video_device[vfd->minor]=NULL;
class_device_unregister(&vfd->class_dev);
up(&videodev_lock); up(&videodev_lock);
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment