From 53de899b707730eb70b95b5a90cd1519a795c88a Mon Sep 17 00:00:00 2001 From: Jean-Francois Moine Date: Sat, 22 Nov 2008 12:26:26 +0100 Subject: gspca: Fix an access to freed memory at disconnect time. From: leandro Costantino On disconnection (USB or rmmod subdriver), the device is freed by video_unregister_device(). Setting the 'present' and 'streaming' flags must be done before the call to this function. Priority: high Signed-off-by: leandro Costantino Signed-off-by: Jean-Francois Moine --- linux/drivers/media/video/gspca/gspca.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) (limited to 'linux/drivers/media/video/gspca') diff --git a/linux/drivers/media/video/gspca/gspca.c b/linux/drivers/media/video/gspca/gspca.c index 404461b8a..d725663fc 100644 --- a/linux/drivers/media/video/gspca/gspca.c +++ b/linux/drivers/media/video/gspca/gspca.c @@ -1916,14 +1916,15 @@ void gspca_disconnect(struct usb_interface *intf) { struct gspca_dev *gspca_dev = usb_get_intfdata(intf); + gspca_dev->present = 0; + gspca_dev->streaming = 0; + usb_set_intfdata(intf, NULL); -/* We don't want people trying to open up the device */ + /* release the device */ + /* (this will call gspca_release() immediatly or on last close) */ video_unregister_device(&gspca_dev->vdev); - gspca_dev->present = 0; - gspca_dev->streaming = 0; - PDEBUG(D_PROBE, "disconnect complete"); } EXPORT_SYMBOL(gspca_disconnect); -- cgit v1.2.3