[media] v4l: Fix use-after-free case in v4l2_device_release
Drivers that have no v4l2_device release callback might free the v4l2_device instance in the video_device release callback. Make sure we don't access the v4l2_device instance after it gets freed. Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
This commit is contained in:
parent
dd182e5416
commit
8280b662df
|
@ -173,6 +173,17 @@ static void v4l2_device_release(struct device *cd)
|
||||||
media_device_unregister_entity(&vdev->entity);
|
media_device_unregister_entity(&vdev->entity);
|
||||||
#endif
|
#endif
|
||||||
|
|
||||||
|
/* Do not call v4l2_device_put if there is no release callback set.
|
||||||
|
* Drivers that have no v4l2_device release callback might free the
|
||||||
|
* v4l2_dev instance in the video_device release callback below, so we
|
||||||
|
* must perform this check here.
|
||||||
|
*
|
||||||
|
* TODO: In the long run all drivers that use v4l2_device should use the
|
||||||
|
* v4l2_device release callback. This check will then be unnecessary.
|
||||||
|
*/
|
||||||
|
if (v4l2_dev->release == NULL)
|
||||||
|
v4l2_dev = NULL;
|
||||||
|
|
||||||
/* Release video_device and perform other
|
/* Release video_device and perform other
|
||||||
cleanups as needed. */
|
cleanups as needed. */
|
||||||
vdev->release(vdev);
|
vdev->release(vdev);
|
||||||
|
|
Loading…
Reference in a new issue