linux/drivers/media
Hans Verkuil 672dcd5477 [media] v4l2-device: fix 'use-after-freed' oops
Fix a bug in v4l2_device_unregister where the sd pointer can be dereferenced
after it was freed.

Normally the i2c adapter is removed before this function is called. Removing
the adapter will also unregister all subdevs on that adapter, so generally
v4l2_device_unregister has nothing to do. However, in the case of a platform
i2c bus that bus is generally not freed.

In that case, after freeing the i2c subdevice the code will fall into the
second block when it tests if the subdev is a SPI device. But by that time
the subdev is already freed and the kernel oopses.

The fix is trivial: continue with the loop after freeing the i2c or spi
subdevice.

Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Reported-by: Daniel Drake <dsd@laptop.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2011-01-19 11:52:14 -02:00
..
common [media] saa7134: Kworld SBTVD: make both analog and digital to work 2011-01-19 11:45:28 -02:00
dvb [media] firedtv: fix remote control with newer Xorg evdev 2011-01-19 11:45:59 -02:00
radio [media] radio-aimslab.c needs #include <linux/delay.h> 2011-01-19 11:45:57 -02:00
rc [media] ir-raw: fix sparse non-ANSI function warning 2011-01-19 11:45:56 -02:00
video [media] v4l2-device: fix 'use-after-freed' oops 2011-01-19 11:52:14 -02:00
Kconfig [media] dabusb: Move it to staging to be deprecated 2010-12-29 08:17:15 -02:00
Makefile [media] rename drivers/media/IR to drives/media/rc 2010-12-29 08:16:36 -02:00