lkml.org 
[lkml]   [2017]   [Oct]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[RFT] media: dvb_frontend: Fix use-after-free in __dvb_frontend_free
Date
Here, dvb_free_device will free dvb_device. dvb_frontend_invoke_release
is using dvb_device after free.

Signed-off-by: Arvind Yadav <arvind.yadav.cs@gmail.com>
---
This bug report by Andrey Konovalov (usb/media/dtt200u: use-after-free
in __dvb_frontend_free).

drivers/media/dvb-core/dvb_frontend.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/media/dvb-core/dvb_frontend.c b/drivers/media/dvb-core/dvb_frontend.c
index 2fcba16..7f1ef12 100644
--- a/drivers/media/dvb-core/dvb_frontend.c
+++ b/drivers/media/dvb-core/dvb_frontend.c
@@ -147,10 +147,10 @@ static void dvb_frontend_free(struct kref *ref)
container_of(ref, struct dvb_frontend, refcount);
struct dvb_frontend_private *fepriv = fe->frontend_priv;

- dvb_free_device(fepriv->dvbdev);
-
dvb_frontend_invoke_release(fe, fe->ops.release);

+ dvb_free_device(fepriv->dvbdev);
+
kfree(fepriv);
}

--
1.9.1
\
 
 \ /
  Last update: 2017-10-24 13:38    [W:0.030 / U:0.128 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site