openkylin
/
linux
mirror of https://gitee.com/openkylin/linux.git
9
0
Fork 0
Code Issues Projects Releases Wiki Activity

V4L/DVB (3790): Use after free in drivers/media/video/em28xx/em28xx-video.c 

In several places we use dev->devno right after we kfree() dev.  This fixes
coverity bug id #1065

Signed-off-by: Eric Sesterhenn <snakebyte@gmx.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
This commit is contained in:
Eric Sesterhenn 2006-04-11 18:19:33 -03:00 committed by Mauro Carvalho Chehab
parent b37492be25
commit 7c908fbb01
1 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
drivers/media/video/em28xx/em28xx-video.c
View File

@ -1576,8 +1576,8 @@ static int em28xx_init_dev(struct em28xx **devhandle, struct usb_device *udev,
errCode = em28xx_config(dev); errCode = em28xx_config(dev);
if (errCode) { if (errCode) {
em28xx_errdev("error configuring device\n"); em28xx_errdev("error configuring device\n");
kfree(dev);
em28xx_devused&=~(1<<dev->devno); em28xx_devused&=~(1<<dev->devno);
kfree(dev);
return -ENOMEM; return -ENOMEM;
} }
@ -1603,8 +1603,8 @@ static int em28xx_init_dev(struct em28xx **devhandle, struct usb_device *udev,
dev->vdev = video_device_alloc(); dev->vdev = video_device_alloc();
if (NULL == dev->vdev) { if (NULL == dev->vdev) {
em28xx_errdev("cannot allocate video_device.\n"); em28xx_errdev("cannot allocate video_device.\n");
kfree(dev);
em28xx_devused&=~(1<<dev->devno); em28xx_devused&=~(1<<dev->devno);
kfree(dev);
return -ENOMEM; return -ENOMEM;
} }
@ -1612,8 +1612,8 @@ static int em28xx_init_dev(struct em28xx **devhandle, struct usb_device *udev,
if (NULL == dev->vbi_dev) { if (NULL == dev->vbi_dev) {
em28xx_errdev("cannot allocate video_device.\n"); em28xx_errdev("cannot allocate video_device.\n");
kfree(dev->vdev); kfree(dev->vdev);
kfree(dev);
em28xx_devused&=~(1<<dev->devno); em28xx_devused&=~(1<<dev->devno);
kfree(dev);
return -ENOMEM; return -ENOMEM;
} }
@ -1650,8 +1650,8 @@ static int em28xx_init_dev(struct em28xx **devhandle, struct usb_device *udev,
mutex_unlock(&dev->lock); mutex_unlock(&dev->lock);
list_del(&dev->devlist); list_del(&dev->devlist);
video_device_release(dev->vdev); video_device_release(dev->vdev);
kfree(dev);
em28xx_devused&=~(1<<dev->devno); em28xx_devused&=~(1<<dev->devno);
kfree(dev);
return -ENODEV; return -ENODEV;
} }
@ -1662,8 +1662,8 @@ static int em28xx_init_dev(struct em28xx **devhandle, struct usb_device *udev,
list_del(&dev->devlist); list_del(&dev->devlist);
video_device_release(dev->vbi_dev); video_device_release(dev->vbi_dev);
video_device_release(dev->vdev); video_device_release(dev->vdev);
kfree(dev);
em28xx_devused&=~(1<<dev->devno); em28xx_devused&=~(1<<dev->devno);
kfree(dev);
return -ENODEV; return -ENODEV;
} else { } else {
printk("registered VBI\n"); printk("registered VBI\n");