dvb_usb_device_exit() frees and uses the device name in that order
Fix by storing the name in a buffer before freeing it
v2: fixed style issues
Signed-off-by: Oliver Neukum <oneukum@xxxxxxxx>
Reported-by: syzbot+26ec41e9f788b3eba396@xxxxxxxxxxxxxxxxxxxxxxxxx
---
drivers/media/usb/dvb-usb/dvb-usb-init.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/media/usb/dvb-usb/dvb-usb-init.c b/drivers/media/usb/dvb-usb/dvb-usb-init.c
index 99951e02a880..959bbdad8f00 100644
--- a/drivers/media/usb/dvb-usb/dvb-usb-init.c
+++ b/drivers/media/usb/dvb-usb/dvb-usb-init.c
@@ -288,13 +288,18 @@ void dvb_usb_device_exit(struct usb_interface *intf)
{
struct dvb_usb_device *d = usb_get_intfdata(intf);
const char *name = "generic DVB-USB module";
+ char identifier[40];
usb_set_intfdata(intf, NULL);
if (d != NULL && d->desc != NULL) {
name = d->desc->name;
+ memcpy(identifier, name, 39);
+ identifier[39] = 0;
dvb_usb_exit(d);
+ } else {
+ memcpy(identifier, name, 39);
}
- info("%s successfully deinitialized and disconnected.", name);
+ info("%s successfully deinitialized and disconnected.", identifier);
}
EXPORT_SYMBOL(dvb_usb_device_exit);
--
2.16.4
