In cal_remove(), unregister the video devices as the first operation,
before cleaning up the V4L2 objects, to avoid user-after-free. This
isn't a complete solution yet, as video nodes can be kept open across
unregistration.
Signed-off-by: Laurent Pinchart <laurent.pinchart@xxxxxxxxxxxxxxxx>
---
drivers/media/platform/ti-vpe/cal.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/media/platform/ti-vpe/cal.c b/drivers/media/platform/ti-vpe/cal.c
index 1af64c144653..b8c7ad8e39cd 100644
--- a/drivers/media/platform/ti-vpe/cal.c
+++ b/drivers/media/platform/ti-vpe/cal.c
@@ -2319,11 +2319,11 @@ static int cal_remove(struct platform_device *pdev)
if (ctx) {
ctx_dbg(1, ctx, "unregistering %s\n",
video_device_node_name(&ctx->vdev));
- cal_camerarx_disable(ctx->phy);
- v4l2_async_notifier_unregister(&ctx->notifier);
- v4l2_async_notifier_cleanup(&ctx->notifier);
- cal_ctx_v4l2_cleanup(ctx);
cal_ctx_v4l2_unregister(ctx);
+ cal_camerarx_disable(ctx->phy);
+ v4l2_async_notifier_unregister(&ctx->notifier);
+ v4l2_async_notifier_cleanup(&ctx->notifier);
+ cal_ctx_v4l2_cleanup(ctx);
}
}
--
Regards,
Laurent Pinchart
