From 266e8ae37daa04fb3d89759305659f4e0acbc126 Mon Sep 17 00:00:00 2001 From: Jesper Juhl Date: Sun, 4 Mar 2012 16:25:04 -0300 Subject: [media] media, cx231xx: Fix double free on close In cx231xx_v4l2_close() there are two calls to cx231xx_release_resources(dev) followed by kfree(dev). That is a problem since cx231xx_release_resources() already kfree()'s its argument, so we end up doing a double free. Easily resolved by just removing the redundant kfree() calls after the calls to cx231xx_release_resources(). I also changed the 'dev = NULL' assignments (which are rather pointless since 'dev' is about to go out of scope), to 'fh->dev = NULL' since it looks to me that that is what was actually intended. And I removed the 'dev = NULL' assignment at the end of cx231xx_release_resources() since it is pointless. Signed-off-by: Jesper Juhl Signed-off-by: Mauro Carvalho Chehab --- drivers/media/video/cx231xx/cx231xx-video.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) (limited to 'drivers/media/video/cx231xx/cx231xx-video.c') diff --git a/drivers/media/video/cx231xx/cx231xx-video.c b/drivers/media/video/cx231xx/cx231xx-video.c index 829a41b0c9e..7f916f0685e 100644 --- a/drivers/media/video/cx231xx/cx231xx-video.c +++ b/drivers/media/video/cx231xx/cx231xx-video.c @@ -2319,8 +2319,7 @@ static int cx231xx_v4l2_close(struct file *filp) if (dev->state & DEV_DISCONNECTED) { if (atomic_read(&dev->devlist_count) > 0) { cx231xx_release_resources(dev); - kfree(dev); - dev = NULL; + fh->dev = NULL; return 0; } return 0; @@ -2350,8 +2349,7 @@ static int cx231xx_v4l2_close(struct file *filp) free the remaining resources */ if (dev->state & DEV_DISCONNECTED) { cx231xx_release_resources(dev); - kfree(dev); - dev = NULL; + fh->dev = NULL; return 0; } -- cgit v1.2.3