aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorEric Sesterhenn <snakebyte@gmx.de>2006-04-11 18:19:33 -0300
committerMauro Carvalho Chehab <mchehab@infradead.org>2006-05-12 19:54:59 -0300
commit7c908fbb0139fa1080412d0590189abfe2df87eb (patch)
tree2cec8f26118a835e47f5c37d399b4384a96478d9
parentb37492be25be5ff0551bff8b479e783498ebe838 (diff)
V4L/DVB (3790): Use after free in drivers/media/video/em28xx/em28xx-video.c
In several places we use dev->devno right after we kfree() dev. This fixes coverity bug id #1065 Signed-off-by: Eric Sesterhenn <snakebyte@gmx.de> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
-rw-r--r--drivers/media/video/em28xx/em28xx-video.c10
1 files changed, 5 insertions, 5 deletions
diff --git a/drivers/media/video/em28xx/em28xx-video.c b/drivers/media/video/em28xx/em28xx-video.c
index ddc92cbb527..cf7cdf9ef61 100644
--- a/drivers/media/video/em28xx/em28xx-video.c
+++ b/drivers/media/video/em28xx/em28xx-video.c
@@ -1576,8 +1576,8 @@ static int em28xx_init_dev(struct em28xx **devhandle, struct usb_device *udev,
errCode = em28xx_config(dev);
if (errCode) {
em28xx_errdev("error configuring device\n");
- kfree(dev);
em28xx_devused&=~(1<<dev->devno);
+ kfree(dev);
return -ENOMEM;
}
@@ -1603,8 +1603,8 @@ static int em28xx_init_dev(struct em28xx **devhandle, struct usb_device *udev,
dev->vdev = video_device_alloc();
if (NULL == dev->vdev) {
em28xx_errdev("cannot allocate video_device.\n");
- kfree(dev);
em28xx_devused&=~(1<<dev->devno);
+ kfree(dev);
return -ENOMEM;
}
@@ -1612,8 +1612,8 @@ static int em28xx_init_dev(struct em28xx **devhandle, struct usb_device *udev,
if (NULL == dev->vbi_dev) {
em28xx_errdev("cannot allocate video_device.\n");
kfree(dev->vdev);
- kfree(dev);
em28xx_devused&=~(1<<dev->devno);
+ kfree(dev);
return -ENOMEM;
}
@@ -1650,8 +1650,8 @@ static int em28xx_init_dev(struct em28xx **devhandle, struct usb_device *udev,
mutex_unlock(&dev->lock);
list_del(&dev->devlist);
video_device_release(dev->vdev);
- kfree(dev);
em28xx_devused&=~(1<<dev->devno);
+ kfree(dev);
return -ENODEV;
}
@@ -1662,8 +1662,8 @@ static int em28xx_init_dev(struct em28xx **devhandle, struct usb_device *udev,
list_del(&dev->devlist);
video_device_release(dev->vbi_dev);
video_device_release(dev->vdev);
- kfree(dev);
em28xx_devused&=~(1<<dev->devno);
+ kfree(dev);
return -ENODEV;
} else {
printk("registered VBI\n");