summaryrefslogtreecommitdiffstats
path: root/drivers/media
diff options
context:
space:
mode:
authorHans Verkuil <hverkuil@xs4all.nl>2011-09-06 10:23:18 -0300
committerMauro Carvalho Chehab <mchehab@redhat.com>2011-09-21 22:17:43 -0300
commit8280b662df96f4172c4972b14a4aec0daf272b8f (patch)
tree774e688fe12b1cbbc2495f7a250fe4901d0bec6f /drivers/media
parentdd182e5416e872e30d90cf071758eec1cf6340d5 (diff)
downloadop-kernel-dev-8280b662df96f4172c4972b14a4aec0daf272b8f.zip
op-kernel-dev-8280b662df96f4172c4972b14a4aec0daf272b8f.tar.gz
[media] v4l: Fix use-after-free case in v4l2_device_release
Drivers that have no v4l2_device release callback might free the v4l2_device instance in the video_device release callback. Make sure we don't access the v4l2_device instance after it gets freed. Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Diffstat (limited to 'drivers/media')
-rw-r--r--drivers/media/video/v4l2-dev.c11
1 files changed, 11 insertions, 0 deletions
diff --git a/drivers/media/video/v4l2-dev.c b/drivers/media/video/v4l2-dev.c
index 06f1400..d721565 100644
--- a/drivers/media/video/v4l2-dev.c
+++ b/drivers/media/video/v4l2-dev.c
@@ -173,6 +173,17 @@ static void v4l2_device_release(struct device *cd)
media_device_unregister_entity(&vdev->entity);
#endif
+ /* Do not call v4l2_device_put if there is no release callback set.
+ * Drivers that have no v4l2_device release callback might free the
+ * v4l2_dev instance in the video_device release callback below, so we
+ * must perform this check here.
+ *
+ * TODO: In the long run all drivers that use v4l2_device should use the
+ * v4l2_device release callback. This check will then be unnecessary.
+ */
+ if (v4l2_dev->release == NULL)
+ v4l2_dev = NULL;
+
/* Release video_device and perform other
cleanups as needed. */
vdev->release(vdev);
OpenPOWER on IntegriCloud