提交 5b83cfa9 编写于 作者: D Dan Carpenter 提交者: Mauro Carvalho Chehab

V4L/DVB (11515): drivers/media/video/saa5249.c: fix use-after-free and leak

I moved the kfree() down a couple lines.  t->vdev is going to be in freed
memory so there is no point setting it to NULL.  I added a kfree(t) on a
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>
上级 3964b58a
...@@ -598,6 +598,7 @@ static int saa5249_probe(struct i2c_client *client, ...@@ -598,6 +598,7 @@ static int saa5249_probe(struct i2c_client *client,
/* Now create a video4linux device */ /* Now create a video4linux device */
t->vdev = video_device_alloc(); t->vdev = video_device_alloc();
if (t->vdev == NULL) { if (t->vdev == NULL) {
kfree(t);
kfree(client); kfree(client);
return -ENOMEM; return -ENOMEM;
} }
...@@ -617,9 +618,8 @@ static int saa5249_probe(struct i2c_client *client, ...@@ -617,9 +618,8 @@ static int saa5249_probe(struct i2c_client *client,
/* Register it */ /* Register it */
err = video_register_device(t->vdev, VFL_TYPE_VTX, -1); err = video_register_device(t->vdev, VFL_TYPE_VTX, -1);
if (err < 0) { if (err < 0) {
kfree(t);
video_device_release(t->vdev); video_device_release(t->vdev);
t->vdev = NULL; kfree(t);
return err; return err;
} }
return 0; return 0;
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册