* [PATCH] [media] media-entity: fix backlink removal on __media_entity_remove_link()
@ 2015-12-10 17:33 Mauro Carvalho Chehab
0 siblings, 0 replies; only message in thread
From: Mauro Carvalho Chehab @ 2015-12-10 17:33 UTC (permalink / raw)
Cc: Mauro Carvalho Chehab, Linux Media Mailing List, Mauro Carvalho Chehab
The logic is testing if num_links==0 at the wrong place. Due to
that, a backlink may be kept without removal, causing KASAN
to complain about usage after free during either entity or
link removal.
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
---
drivers/media/media-entity.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/media/media-entity.c b/drivers/media/media-entity.c
index d7243cb56c79..d9d42fab22ad 100644
--- a/drivers/media/media-entity.c
+++ b/drivers/media/media-entity.c
@@ -662,13 +662,13 @@ static void __media_entity_remove_link(struct media_entity *entity,
if (link->source->entity == entity)
remote->num_backlinks--;
- if (--remote->num_links == 0)
- break;
-
/* Remove the remote link */
list_del(&rlink->list);
media_gobj_remove(&rlink->graph_obj);
kfree(rlink);
+
+ if (--remote->num_links == 0)
+ break;
}
list_del(&link->list);
media_gobj_remove(&link->graph_obj);
--
2.5.0
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2015-12-10 17:34 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2015-12-10 17:33 [PATCH] [media] media-entity: fix backlink removal on __media_entity_remove_link() Mauro Carvalho Chehab
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.