]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
media: dvb: usb: fix use after free in dvb_usb_device_exit
authorOliver Neukum <oneukum@suse.com>
Tue, 30 Apr 2019 13:07:36 +0000 (09:07 -0400)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 26 Jul 2019 07:12:24 +0000 (09:12 +0200)
commitd1b2021c98845fe4d32571f6e9e8432a7d63cd22
tree306cbe070fccfd4a93500bd4194d32a62bb18942
parent6c2ab28a434c00b091a5ab56b6cf96773ad74d92
media: dvb: usb: fix use after free in dvb_usb_device_exit

[ Upstream commit 6cf97230cd5f36b7665099083272595c55d72be7 ]

dvb_usb_device_exit() frees and uses the device name in that order.
Fix by storing the name in a buffer before freeing it.

Signed-off-by: Oliver Neukum <oneukum@suse.com>
Reported-by: syzbot+26ec41e9f788b3eba396@syzkaller.appspotmail.com
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/media/usb/dvb-usb/dvb-usb-init.c