From 266e8ae37daa04fb3d89759305659f4e0acbc126 Mon Sep 17 00:00:00 2001 From: Jesper Juhl Date: Sun, 4 Mar 2012 16:25:04 -0300 Subject: [media] media, cx231xx: Fix double free on close In cx231xx_v4l2_close() there are two calls to cx231xx_release_resources(dev) followed by kfree(dev). That is a problem since cx231xx_release_resources() already kfree()'s its argument, so we end up doing a double free. Easily resolved by just removing the redundant kfree() calls after the calls to cx231xx_release_resources(). I also changed the 'dev = NULL' assignments (which are rather pointless since 'dev' is about to go out of scope), to 'fh->dev = NULL' since it looks to me that that is what was actually intended. And I removed the 'dev = NULL' assignment at the end of cx231xx_release_resources() since it is pointless. Signed-off-by: Jesper Juhl Signed-off-by: Mauro Carvalho Chehab --- drivers/media/video/cx231xx/cx231xx-cards.c | 1 - drivers/media/video/cx231xx/cx231xx-video.c | 6 ++---- 2 files changed, 2 insertions(+), 5 deletions(-) (limited to 'drivers/media/video/cx231xx') diff --git a/drivers/media/video/cx231xx/cx231xx-cards.c b/drivers/media/video/cx231xx/cx231xx-cards.c index 875a7ce94736..8ed460d692e0 100644 --- a/drivers/media/video/cx231xx/cx231xx-cards.c +++ b/drivers/media/video/cx231xx/cx231xx-cards.c @@ -861,7 +861,6 @@ void cx231xx_release_resources(struct cx231xx *dev) kfree(dev->sliced_cc_mode.alt_max_pkt_size); kfree(dev->ts1_mode.alt_max_pkt_size); kfree(dev); - dev = NULL; } /* diff --git a/drivers/media/video/cx231xx/cx231xx-video.c b/drivers/media/video/cx231xx/cx231xx-video.c index 829a41b0c9ef..7f916f0685e9 100644 --- a/drivers/media/video/cx231xx/cx231xx-video.c +++ b/drivers/media/video/cx231xx/cx231xx-video.c @@ -2319,8 +2319,7 @@ static int cx231xx_v4l2_close(struct file *filp) if (dev->state & DEV_DISCONNECTED) { if (atomic_read(&dev->devlist_count) > 0) { cx231xx_release_resources(dev); - kfree(dev); - dev = NULL; + fh->dev = NULL; return 0; } return 0; @@ -2350,8 +2349,7 @@ static int cx231xx_v4l2_close(struct file *filp) free the remaining resources */ if (dev->state & DEV_DISCONNECTED) { cx231xx_release_resources(dev); - kfree(dev); - dev = NULL; + fh->dev = NULL; return 0; } -- cgit v1.2.3-59-g8ed1b