]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
media: dvb: usb: fix use after free in dvb_usb_device_exit
authorOliver Neukum <oneukum@suse.com>
Tue, 30 Apr 2019 13:07:36 +0000 (09:07 -0400)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sun, 4 Aug 2019 07:34:40 +0000 (09:34 +0200)
commit7e95655b54ca06487eb95595f3b95ad829b81dc8
tree86ba89e08cddfcfece8567174d75a8e538bbea47
parent11648a3cc09d871898ba89383a2095f895f27995
media: dvb: usb: fix use after free in dvb_usb_device_exit

[ Upstream commit 6cf97230cd5f36b7665099083272595c55d72be7 ]

dvb_usb_device_exit() frees and uses the device name in that order.
Fix by storing the name in a buffer before freeing it.

Signed-off-by: Oliver Neukum <oneukum@suse.com>
Reported-by: syzbot+26ec41e9f788b3eba396@syzkaller.appspotmail.com
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/media/usb/dvb-usb/dvb-usb-init.c