diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2020-12-14 12:54:47 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2021-03-04 11:37:37 +0100 |
| commit | e559765186ac6da502bdbe23490a7eda2639de6e (patch) | |
| tree | 2c3a07c661a4f27afe6dc301fbef39ae53dd0de4 /kernel/kcsan/core.c | |
| parent | 5ea0601513a70416814297fbed93e7b749991c46 (diff) | |
| download | kernel_replicant_linux-e559765186ac6da502bdbe23490a7eda2639de6e.tar.gz kernel_replicant_linux-e559765186ac6da502bdbe23490a7eda2639de6e.tar.bz2 kernel_replicant_linux-e559765186ac6da502bdbe23490a7eda2639de6e.zip | |
media: allegro: Fix use after free on error
[ Upstream commit ce814ad4bb52bfc7c0472e6da0aa742ab88f4361 ]
The "channel" is added to the "dev->channels" but then if
v4l2_m2m_ctx_init() fails then we free "channel" but it's still on the
list so it could lead to a use after free. Let's not add it to the
list until after v4l2_m2m_ctx_init() succeeds.
Fixes: cc62c74749a3 ("media: allegro: add missed checks in allegro_open()")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Michael Tretter <m.tretter@pengutronix.de>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'kernel/kcsan/core.c')
0 files changed, 0 insertions, 0 deletions