From e7cd17a29d72868aa5cfbbd4de7c54a28ed30ff0 Mon Sep 17 00:00:00 2001 From: Max Kellermann Date: Tue, 9 Aug 2016 18:33:03 -0300 Subject: [PATCH] [media] drivers/media/media-device: fix double free bug in _unregister() While removing all interfaces in media_device_unregister(), all media_interface pointers are freed. This is illegal and results in double kfree() if any media_interface is still linked at this point; maybe because a userspace process still has a file handle. Once the process closes the file handle, dvb_media_device_free() gets called, which frees the dvb_device.intf_devnode again. This patch removes the unnecessary kfree() call, and documents who's responsible for really freeing it. Signed-off-by: Max Kellermann Signed-off-by: Mauro Carvalho Chehab --- drivers/media/media-device.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/media/media-device.c b/drivers/media/media-device.c index 2783531f9fc0..219ab5fc8b4c 100644 --- a/drivers/media/media-device.c +++ b/drivers/media/media-device.c @@ -801,9 +801,13 @@ void media_device_unregister(struct media_device *mdev) /* Remove all interfaces from the media device */ list_for_each_entry_safe(intf, tmp_intf, &mdev->interfaces, graph_obj.list) { + /* + * Unlink the interface, but don't free it here; the + * module which created it is responsible for freeing + * it + */ __media_remove_intf_links(intf); media_gobj_destroy(&intf->graph_obj); - kfree(intf); } mutex_unlock(&mdev->graph_mutex);