leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

media: lgdt3306a: Fix a double kfree on i2c device remove

Browse Source 
Both lgdt33606a_release and lgdt3306a_remove kfree state, but _release is
called first, then _remove operates on states members before kfree'ing it.
This can lead to random oops/GPF/etc on USB disconnect.

Signed-off-by: Brad Love <brad@nextdimension.cc>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
This commit is contained in:
Brad Love 2018-01-05 09:57:13 -05:00 committed by Mauro Carvalho Chehab
parent 835d66173a
commit 94448e21cf
1 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
drivers/media/dvb-frontends/lgdt3306a.c
View File

@ -1814,7 +1814,13 @@ static void lgdt3306a_release(struct dvb_frontend *fe)
struct lgdt3306a_state *state = fe->demodulator_priv; struct lgdt3306a_state *state = fe->demodulator_priv;
dbg_info("\n"); dbg_info("\n");
kfree(state);
/*
* If state->muxc is not NULL, then we are an i2c device
* and lgdt3306a_remove will clean up state
*/
if (!state->muxc)
kfree(state);
} }
static const struct dvb_frontend_ops lgdt3306a_ops; static const struct dvb_frontend_ops lgdt3306a_ops;