From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Tue, 14 Aug 2012 05:58:15 +0000 (-0300)
Subject: [media] em28xx: use after free in em28xx_v4l2_close()
X-Git-Url: http://drtracing.org/?a=commitdiff_plain;h=e36c92fd63bb4773e6f4bc38ecee11a609ded1cf;p=deliverable%2Flinux.git

[media] em28xx: use after free in em28xx_v4l2_close()

We need to move the unlock before the kfree(dev);

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
---

diff --git a/drivers/media/usb/em28xx/em28xx-video.c b/drivers/media/usb/em28xx/em28xx-video.c
index ecb23df7f16e..78d6ebd712b9 100644
--- a/drivers/media/usb/em28xx/em28xx-video.c
+++ b/drivers/media/usb/em28xx/em28xx-video.c
@@ -2264,9 +2264,9 @@ static int em28xx_v4l2_close(struct file *filp)
 		if (dev->state & DEV_DISCONNECTED) {
 			em28xx_release_resources(dev);
 			kfree(dev->alt_max_pkt_size);
+			mutex_unlock(&dev->lock);
 			kfree(dev);
 			kfree(fh);
-			mutex_unlock(&dev->lock);
 			return 0;
 		}