Re: [patch] [media] usbvision-video: two use after frees

Laurent Pinchart
2014-10-16T08:25:33Z

On Thursday 16 October 2014 10:23:05 Hans Verkuil wrote:
> On 10/16/2014 10:09 AM, Laurent Pinchart wrote:
> > On Thursday 16 October 2014 10:57:21 Dan Carpenter wrote:
> >> The lock has been freed in usbvision_release() so there is no need to
> >> call mutex_unlock() here.
> >
> > Yuck :-/
> >
> > The driver should really be converted to use video_device::release. That
> > might be out of scope for this fix though. Is usbvision maintained ?
>
> I have hardware, and at some point I plan to convert it to modern
> frameworks. But ENOTIME for now. So I guess I might be the closest to a
> being a maintainer.

Can you ack the patch then ? :-)

> >> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> >>
> >> diff --git a/drivers/media/usb/usbvision/usbvision-video.c
> >> b/drivers/media/usb/usbvision/usbvision-video.c index 68bc961..9bfa041
> >> 100644
> >> --- a/drivers/media/usb/usbvision/usbvision-video.c
> >> +++ b/drivers/media/usb/usbvision/usbvision-video.c
> >> @@ -446,6 +446,7 @@ static int usbvision_v4l2_close(struct file *file)
> >> if (usbvision->remove_pending) {
> >> printk(KERN_INFO "%s: Final disconnect\n", __func__);
> >> usbvision_release(usbvision);
> >> + return 0;
> >> }
> >> mutex_unlock(&usbvision->v4l2_lock);
> >>
> >> @@ -1221,6 +1222,7 @@ static int usbvision_radio_close(struct file *file)
> >> if (usbvision->remove_pending) {
> >> printk(KERN_INFO "%s: Final disconnect\n", __func__);
> >> usbvision_release(usbvision);
> >> + return err_code;
> >> }
> >>
> >> mutex_unlock(&usbvision->v4l2_lock);

--
Regards,

Laurent Pinchart