]> git.ipfire.org Git - thirdparty/kernel/stable.git/commitdiff
[media] usbvision-video: two use after frees
authorDan Carpenter <dan.carpenter@oracle.com>
Thu, 16 Oct 2014 07:57:21 +0000 (04:57 -0300)
committerJiri Slaby <jslaby@suse.cz>
Wed, 19 Nov 2014 21:46:10 +0000 (22:46 +0100)
commit 470a9147899500eb4898f77816520c4b4aa1a698 upstream.

The lock has been freed in usbvision_release() so there is no need to
call mutex_unlock() here.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
drivers/media/usb/usbvision/usbvision-video.c

index 5c9e3123ad2eac4dbb98ae5b584a7a016849d38d..661f7f2a9e8bca49eb50b6f580204302867b3df2 100644 (file)
@@ -446,6 +446,7 @@ static int usbvision_v4l2_close(struct file *file)
        if (usbvision->remove_pending) {
                printk(KERN_INFO "%s: Final disconnect\n", __func__);
                usbvision_release(usbvision);
+               return 0;
        }
        mutex_unlock(&usbvision->v4l2_lock);
 
@@ -1221,6 +1222,7 @@ static int usbvision_radio_close(struct file *file)
        if (usbvision->remove_pending) {
                printk(KERN_INFO "%s: Final disconnect\n", __func__);
                usbvision_release(usbvision);
+               return err_code;
        }
 
        mutex_unlock(&usbvision->v4l2_lock);