From 6e298d58473520a806d59b7aa51dcb194d1a1b03 Mon Sep 17 00:00:00 2001 From: Dan Carpenter Date: Fri, 22 Sep 2017 09:48:41 -0400 Subject: [PATCH] media: stk-webcam: Fix use after free on disconnect We free the stk_camera device too early. It's allocate first in probe and it should be freed last in stk_camera_disconnect(). Reported-by: Andrey Konovalov Signed-off-by: Dan Carpenter Acked-by: Sakari Ailus Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab --- drivers/media/usb/stkwebcam/stk-webcam.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/media/usb/stkwebcam/stk-webcam.c b/drivers/media/usb/stkwebcam/stk-webcam.c index c0bba77..e748c97 100644 --- a/drivers/media/usb/stkwebcam/stk-webcam.c +++ b/drivers/media/usb/stkwebcam/stk-webcam.c @@ -1241,7 +1241,6 @@ static void stk_v4l_dev_release(struct video_device *vd) if (dev->sio_bufs != NULL || dev->isobufs != NULL) pr_err("We are leaking memory\n"); usb_put_intf(dev->interface); - kfree(dev); } static const struct video_device stk_v4l_data = { @@ -1391,6 +1390,7 @@ static void stk_camera_disconnect(struct usb_interface *interface) video_unregister_device(&dev->vdev); v4l2_ctrl_handler_free(&dev->hdl); v4l2_device_unregister(&dev->v4l2_dev); + kfree(dev); } #ifdef CONFIG_PM -- 2.7.4