提交 eb83a517 编写于 作者: M Mauro Carvalho Chehab

[media] media-entity: fix backlink removal on __media_entity_remove_link()

The logic is testing if num_links==0 at the wrong place. Due to
that, a backlink may be kept without removal, causing KASAN
to complain about usage after free during either entity or
link removal.
Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>
上级 a9709e43
......@@ -662,13 +662,13 @@ static void __media_entity_remove_link(struct media_entity *entity,
if (link->source->entity == entity)
remote->num_backlinks--;
if (--remote->num_links == 0)
break;
/* Remove the remote link */
list_del(&rlink->list);
media_gobj_remove(&rlink->graph_obj);
kfree(rlink);
if (--remote->num_links == 0)
break;
}
list_del(&link->list);
media_gobj_remove(&link->graph_obj);
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册