| From bf65f8aabdb37bc1a785884374e919477fe13e10 Mon Sep 17 00:00:00 2001 |
| From: Oliver Neukum <oneukum@suse.com> |
| Date: Thu, 24 Sep 2020 11:14:10 +0200 |
| Subject: media: usbtv: Fix refcounting mixup |
| |
| From: Oliver Neukum <oneukum@suse.com> |
| |
| commit bf65f8aabdb37bc1a785884374e919477fe13e10 upstream. |
| |
| The premature free in the error path is blocked by V4L |
| refcounting, not USB refcounting. Thanks to |
| Ben Hutchings for review. |
| |
| [v2] corrected attributions |
| |
| Signed-off-by: Oliver Neukum <oneukum@suse.com> |
| Fixes: 50e704453553 ("media: usbtv: prevent double free in error case") |
| CC: stable@vger.kernel.org |
| Reported-by: Ben Hutchings <ben.hutchings@codethink.co.uk> |
| Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> |
| Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| drivers/media/usb/usbtv/usbtv-core.c | 3 ++- |
| 1 file changed, 2 insertions(+), 1 deletion(-) |
| |
| --- a/drivers/media/usb/usbtv/usbtv-core.c |
| +++ b/drivers/media/usb/usbtv/usbtv-core.c |
| @@ -113,7 +113,8 @@ static int usbtv_probe(struct usb_interf |
| |
| usbtv_audio_fail: |
| /* we must not free at this point */ |
| - usb_get_dev(usbtv->udev); |
| + v4l2_device_get(&usbtv->v4l2_dev); |
| + /* this will undo the v4l2_device_get() */ |
| usbtv_video_free(usbtv); |
| |
| usbtv_video_fail: |
