Skip to content

Commit

Permalink
media: usbtv: Fix refcounting mixup
Browse files Browse the repository at this point in the history
The premature free in the error path is blocked by V4L
refcounting, not USB refcounting. Thanks to
Ben Hutchings for review.

[v2] corrected attributions

Signed-off-by: Oliver Neukum <oneukum@suse.com>
Fixes: 50e7044 ("media: usbtv: prevent double free in error case")
CC: stable@vger.kernel.org
Reported-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
  • Loading branch information
oneukum authored and mchehab committed Oct 8, 2020
1 parent 0cef13d commit bf65f8a
Showing 1 changed file with 2 additions and 1 deletion.
3 changes: 2 additions & 1 deletion drivers/media/usb/usbtv/usbtv-core.c
Original file line number Diff line number Diff line change
Expand Up @@ -113,7 +113,8 @@ static int usbtv_probe(struct usb_interface *intf,

usbtv_audio_fail:
/* we must not free at this point */
usb_get_dev(usbtv->udev);
v4l2_device_get(&usbtv->v4l2_dev);
/* this will undo the v4l2_device_get() */
usbtv_video_free(usbtv);

usbtv_video_fail:
Expand Down

0 comments on commit bf65f8a

Please sign in to comment.