Here, double-free is happening on error path of hdpvr_probe.
error_v4l2_unregister:
v4l2_device_unregister(&dev->v4l2_dev);
=>
v4l2_device_disconnect
=>
put_device
=>
kobject_put
=>
kref_put
=>
v4l2_device_release
=>
hdpvr_device_release (CALLBACK)
=>
kfree(dev)
error_free_dev:
kfree(dev)
Signed-off-by: Arvind Yadav <arvind.yadav.cs@xxxxxxxxx>
---
reported by:
Dan Carpenter<dan.carpenter@xxxxxxxxxx>
drivers/media/usb/hdpvr/hdpvr-core.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/media/usb/hdpvr/hdpvr-core.c b/drivers/media/usb/hdpvr/hdpvr-core.c
index 29ac7fc..cab100a0 100644
--- a/drivers/media/usb/hdpvr/hdpvr-core.c
+++ b/drivers/media/usb/hdpvr/hdpvr-core.c
@@ -395,6 +395,7 @@ static int hdpvr_probe(struct usb_interface *interface,
kfree(dev->usbc_buf);
error_v4l2_unregister:
v4l2_device_unregister(&dev->v4l2_dev);
+ dev = NULL;
error_free_dev:
kfree(dev);
error:
--
1.9.1
