From patchwork Fri Sep 22 13:48:41 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dan Carpenter X-Patchwork-Id: 44426 X-Patchwork-Delegate: hverkuil@xs4all.nl Received: from vger.kernel.org ([209.132.180.67]) by www.linuxtv.org with esmtp (Exim 4.84_2) (envelope-from ) id 1dvOLU-0001Z2-0Y; Fri, 22 Sep 2017 13:50:20 +0000 Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752069AbdIVNs6 (ORCPT + 1 other); Fri, 22 Sep 2017 09:48:58 -0400 Received: from userp1040.oracle.com ([156.151.31.81]:34334 "EHLO userp1040.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751928AbdIVNs5 (ORCPT ); Fri, 22 Sep 2017 09:48:57 -0400 Received: from userv0022.oracle.com (userv0022.oracle.com [156.151.31.74]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v8MDmpel027190 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 22 Sep 2017 13:48:51 GMT Received: from aserv0121.oracle.com (aserv0121.oracle.com [141.146.126.235]) by userv0022.oracle.com (8.14.4/8.14.4) with ESMTP id v8MDmoIb009162 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 22 Sep 2017 13:48:51 GMT Received: from abhmp0003.oracle.com (abhmp0003.oracle.com [141.146.116.9]) by aserv0121.oracle.com (8.14.4/8.13.8) with ESMTP id v8MDmobb008249; Fri, 22 Sep 2017 13:48:50 GMT Received: from mwanda (/197.254.35.146) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Fri, 22 Sep 2017 06:48:49 -0700 Date: Fri, 22 Sep 2017 16:48:41 +0300 From: Dan Carpenter To: Mauro Carvalho Chehab Cc: Hans Verkuil , Bhumika Goyal , Arvind Yadav , Sakari Ailus , Joe Perches , linux-media@vger.kernel.org, LKML Subject: [PATCH] [media] stk-webcam: Fix use after free on disconnect Message-ID: <20170922134841.kxfwwn2yocjgnuad@mwanda> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: X-Mailer: git-send-email haha only kidding User-Agent: NeoMutt/20170609 (1.8.3) X-Source-IP: userv0022.oracle.com [156.151.31.74] Sender: linux-media-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org We free the stk_camera device too early. It's allocate first in probe and it should be freed last in stk_camera_disconnect(). Reported-by: Andrey Konovalov Signed-off-by: Dan Carpenter Acked-by: Sakari Ailus --- Not tested but these bug reports seem surprisingly straight forward. Thanks Andrey! diff --git a/drivers/media/usb/stkwebcam/stk-webcam.c b/drivers/media/usb/stkwebcam/stk-webcam.c index c0bba773db25..e748c976d967 100644 --- a/drivers/media/usb/stkwebcam/stk-webcam.c +++ b/drivers/media/usb/stkwebcam/stk-webcam.c @@ -1241,7 +1241,6 @@ static void stk_v4l_dev_release(struct video_device *vd) if (dev->sio_bufs != NULL || dev->isobufs != NULL) pr_err("We are leaking memory\n"); usb_put_intf(dev->interface); - kfree(dev); } static const struct video_device stk_v4l_data = { @@ -1391,6 +1390,7 @@ static void stk_camera_disconnect(struct usb_interface *interface) video_unregister_device(&dev->vdev); v4l2_ctrl_handler_free(&dev->hdl); v4l2_device_unregister(&dev->v4l2_dev); + kfree(dev); } #ifdef CONFIG_PM