diff options
| author | Mauro Carvalho Chehab <mchehab@infradead.org> | 2006-04-11 18:19:33 -0300 |
|---|---|---|
| committer | Mauro Carvalho Chehab <mchehab@infradead.org> | 2006-04-11 18:19:33 -0300 |
| commit | 25205eb3f46ee7ab26238d27127b83e7b9f6f2cf (patch) | |
| tree | 8f05c9cd915864a1107c020ba31f965758cdbc59 | |
| parent | f87c0d6c0b3286715f8bed1b4194b0fc712cab57 (diff) | |
| download | mediapointer-dvb-s2-25205eb3f46ee7ab26238d27127b83e7b9f6f2cf.tar.gz mediapointer-dvb-s2-25205eb3f46ee7ab26238d27127b83e7b9f6f2cf.tar.bz2 | |
Use after free in drivers/media/video/em28xx/em28xx-video.c
From: Eric Sesterhenn <snakebyte@gmx.de>
In several places we use dev->devno right after we kfree() dev. This fixes
coverity bug id #1065
Signed-off-by: Eric Sesterhenn <snakebyte@gmx.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
| -rw-r--r-- | linux/drivers/media/video/em28xx/em28xx-video.c | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/linux/drivers/media/video/em28xx/em28xx-video.c b/linux/drivers/media/video/em28xx/em28xx-video.c index 1093a68f0..33fe987dd 100644 --- a/linux/drivers/media/video/em28xx/em28xx-video.c +++ b/linux/drivers/media/video/em28xx/em28xx-video.c @@ -1685,8 +1685,8 @@ static int em28xx_init_dev(struct em28xx **devhandle, struct usb_device *udev, errCode = em28xx_config(dev); if (errCode) { em28xx_errdev("error configuring device\n"); - kfree(dev); em28xx_devused&=~(1<<dev->devno); + kfree(dev); return -ENOMEM; } @@ -1712,8 +1712,8 @@ static int em28xx_init_dev(struct em28xx **devhandle, struct usb_device *udev, dev->vdev = video_device_alloc(); if (NULL == dev->vdev) { em28xx_errdev("cannot allocate video_device.\n"); - kfree(dev); em28xx_devused&=~(1<<dev->devno); + kfree(dev); return -ENOMEM; } @@ -1721,8 +1721,8 @@ static int em28xx_init_dev(struct em28xx **devhandle, struct usb_device *udev, if (NULL == dev->vbi_dev) { em28xx_errdev("cannot allocate video_device.\n"); kfree(dev->vdev); - kfree(dev); em28xx_devused&=~(1<<dev->devno); + kfree(dev); return -ENOMEM; } @@ -1765,8 +1765,8 @@ static int em28xx_init_dev(struct em28xx **devhandle, struct usb_device *udev, mutex_unlock(&dev->lock); list_del(&dev->devlist); video_device_release(dev->vdev); - kfree(dev); em28xx_devused&=~(1<<dev->devno); + kfree(dev); return -ENODEV; } @@ -1777,8 +1777,8 @@ static int em28xx_init_dev(struct em28xx **devhandle, struct usb_device *udev, list_del(&dev->devlist); video_device_release(dev->vbi_dev); video_device_release(dev->vdev); - kfree(dev); em28xx_devused&=~(1<<dev->devno); + kfree(dev); return -ENODEV; } else { printk("registered VBI\n"); |