Re: [patch] [media] usbvision-video: two use after frees

Laurent Pinchart
2014-10-16T08:08:59Z

On Thursday 16 October 2014 10:57:21 Dan Carpenter wrote:
> The lock has been freed in usbvision_release() so there is no need to
> call mutex_unlock() here.

Yuck :-/

The driver should really be converted to use video_device::release. That might
be out of scope for this fix though. Is usbvision maintained ?

> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
>
> diff --git a/drivers/media/usb/usbvision/usbvision-video.c
> b/drivers/media/usb/usbvision/usbvision-video.c index 68bc961..9bfa041
> 100644
> --- a/drivers/media/usb/usbvision/usbvision-video.c
> +++ b/drivers/media/usb/usbvision/usbvision-video.c
> @@ -446,6 +446,7 @@ static int usbvision_v4l2_close(struct file *file)
> if (usbvision->remove_pending) {
> printk(KERN_INFO "%s: Final disconnect\n", __func__);
> usbvision_release(usbvision);
> + return 0;
> }
> mutex_unlock(&usbvision->v4l2_lock);
>
> @@ -1221,6 +1222,7 @@ static int usbvision_radio_close(struct file *file)
> if (usbvision->remove_pending) {
> printk(KERN_INFO "%s: Final disconnect\n", __func__);
> usbvision_release(usbvision);
> + return err_code;
> }
>
> mutex_unlock(&usbvision->v4l2_lock);

--
Regards,

Laurent Pinchart