The patch titled
drivers/media/video/saa5249.c: fix use-after-free and leak
has been removed from the -mm tree. Its filename was
drivers-media-video-saa5249c-fix-use-after-free-and-leak.patch
This patch was dropped because it was merged into mainline or a subsystem tree
The current -mm tree may be found at http://userweb.kernel.org/~akpm/mmotm/
------------------------------------------------------
Subject: drivers/media/video/saa5249.c: fix use-after-free and leak
From: Dan Carpenter <error27@xxxxxxxxx>
I moved the kfree() down a couple lines. t->vdev is going to be in freed
memory so there is no point setting it to NULL. I added a kfree(t) on a
different error path.
Signed-off-by: Dan Carpenter <error27@xxxxxxxxx>
Cc: Mauro Carvalho Chehab <mchehab@xxxxxxxxxxxxx>
Cc: Hans Verkuil <hverkuil@xxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---
drivers/media/video/saa5249.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff -puN drivers/media/video/saa5249.c~drivers-media-video-saa5249c-fix-use-after-free-and-leak drivers/media/video/saa5249.c
--- a/drivers/media/video/saa5249.c~drivers-media-video-saa5249c-fix-use-after-free-and-leak
+++ a/drivers/media/video/saa5249.c
@@ -598,6 +598,7 @@ static int saa5249_probe(struct i2c_clie
/* Now create a video4linux device */
t->vdev = video_device_alloc();
if (t->vdev == NULL) {
+ kfree(t);
kfree(client);
return -ENOMEM;
}
@@ -617,9 +618,8 @@ static int saa5249_probe(struct i2c_clie
/* Register it */
err = video_register_device(t->vdev, VFL_TYPE_VTX, -1);
if (err < 0) {
- kfree(t);
video_device_release(t->vdev);
- t->vdev = NULL;
+ kfree(t);
return err;
}
return 0;
_
Patches currently in -mm which might be from error27@xxxxxxxxx are
linux-next.patch
rxrpc-fix-error-handling-for-rxrpc_alloc_connection.patch
--
To unsubscribe from this list: send the line "unsubscribe mm-commits" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
