summaryrefslogtreecommitdiffstats
path: root/drivers/media
diff options
context:
space:
mode:
authorGuennadi Liakhovetski <g.liakhovetski@gmx.de>2009-10-05 12:54:54 -0300
committerMauro Carvalho Chehab <mchehab@redhat.com>2009-11-07 12:55:07 -0200
commit76823b791d867c2ab563c237f188d0cbb4ced6e1 (patch)
tree8dd614f79437063fda0f4860caf61255506f880a /drivers/media
parent07bc46e6671b4533a5e56607ddec9de9079c1844 (diff)
V4L/DVB (13132): fix use-after-free Oops, resulting from a driver-core API change
Commit b4028437876866aba4747a655ede00f892089e14 has broken again re-use of device objects across device_register() / device_unregister() cycles. Fix soc-camera by nullifying the struct after device_unregister(). Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Diffstat (limited to 'drivers/media')
-rw-r--r--drivers/media/video/soc_camera.c16
1 files changed, 9 insertions, 7 deletions
diff --git a/drivers/media/video/soc_camera.c b/drivers/media/video/soc_camera.c
index 59aa7a3694c..36e617bd13c 100644
--- a/drivers/media/video/soc_camera.c
+++ b/drivers/media/video/soc_camera.c
@@ -1160,13 +1160,15 @@ void soc_camera_host_unregister(struct soc_camera_host *ici)
if (icd->iface == ici->nr) {
/* The bus->remove will be called */
device_unregister(&icd->dev);
- /* Not before device_unregister(), .remove
- * needs parent to call ici->ops->remove() */
- icd->dev.parent = NULL;
-
- /* If the host module is loaded again, device_register()
- * would complain "already initialised" */
- memset(&icd->dev.kobj, 0, sizeof(icd->dev.kobj));
+ /*
+ * Not before device_unregister(), .remove
+ * needs parent to call ici->ops->remove().
+ * If the host module is loaded again, device_register()
+ * would complain "already initialised," since 2.6.32
+ * this is also needed to prevent use-after-free of the
+ * device private data.
+ */
+ memset(&icd->dev, 0, sizeof(icd->dev));
}
}