Messages in this thread Patch in this message | | | From | Arvind Yadav <> | Subject | [RFT] media: hdpvr: Fix Double kfree() error | Date | Tue, 20 Mar 2018 16:46:39 +0530 |
| |
Here, double-free is happening on error path of hdpvr_probe.
error_v4l2_unregister: v4l2_device_unregister(&dev->v4l2_dev); => v4l2_device_disconnect => put_device => kobject_put => kref_put => v4l2_device_release => hdpvr_device_release (CALLBACK) => kfree(dev)
error_free_dev: kfree(dev)
Signed-off-by: Arvind Yadav <arvind.yadav.cs@gmail.com> --- reported by: Dan Carpenter<dan.carpenter@oracle.com>
drivers/media/usb/hdpvr/hdpvr-core.c | 1 + 1 file changed, 1 insertion(+)
diff --git a/drivers/media/usb/hdpvr/hdpvr-core.c b/drivers/media/usb/hdpvr/hdpvr-core.c index 29ac7fc..cab100a0 100644 --- a/drivers/media/usb/hdpvr/hdpvr-core.c +++ b/drivers/media/usb/hdpvr/hdpvr-core.c @@ -395,6 +395,7 @@ static int hdpvr_probe(struct usb_interface *interface, kfree(dev->usbc_buf); error_v4l2_unregister: v4l2_device_unregister(&dev->v4l2_dev); + dev = NULL; error_free_dev: kfree(dev); error: -- 1.9.1
| |