From: Hans Verkuil Date: Thu, 16 Oct 2014 08:23:05 +0000 Subject: Re: [patch] [media] usbvision-video: two use after frees Message-Id: <543F8069.8020005@xs4all.nl> List-Id: References: <20141016075721.GC29096@mwanda> <1494643.LQNyJpdPt6@avalon> In-Reply-To: <1494643.LQNyJpdPt6@avalon> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: Laurent Pinchart , Dan Carpenter Cc: Mauro Carvalho Chehab , "Lad, Prabhakar" , Sakari Ailus , linux-media@vger.kernel.org, kernel-janitors@vger.kernel.org On 10/16/2014 10:09 AM, Laurent Pinchart wrote: > On Thursday 16 October 2014 10:57:21 Dan Carpenter wrote: >> The lock has been freed in usbvision_release() so there is no need to >> call mutex_unlock() here. > > Yuck :-/ > > The driver should really be converted to use video_device::release. That might > be out of scope for this fix though. Is usbvision maintained ? I have hardware, and at some point I plan to convert it to modern frameworks. But ENOTIME for now. So I guess I might be the closest to a being a maintainer. Regards, Hans > >> Signed-off-by: Dan Carpenter >> >> diff --git a/drivers/media/usb/usbvision/usbvision-video.c >> b/drivers/media/usb/usbvision/usbvision-video.c index 68bc961..9bfa041 >> 100644 >> --- a/drivers/media/usb/usbvision/usbvision-video.c >> +++ b/drivers/media/usb/usbvision/usbvision-video.c >> @@ -446,6 +446,7 @@ static int usbvision_v4l2_close(struct file *file) >> if (usbvision->remove_pending) { >> printk(KERN_INFO "%s: Final disconnect\n", __func__); >> usbvision_release(usbvision); >> + return 0; >> } >> mutex_unlock(&usbvision->v4l2_lock); >> >> @@ -1221,6 +1222,7 @@ static int usbvision_radio_close(struct file *file) >> if (usbvision->remove_pending) { >> printk(KERN_INFO "%s: Final disconnect\n", __func__); >> usbvision_release(usbvision); >> + return err_code; >> } >> >> mutex_unlock(&usbvision->v4l2_lock); >