The patch below does not apply to the 3.12-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable@vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 7e4b918750b494b68e24222dea5f7d85e90db022 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpen...@oracle.com>
Date: Fri, 1 Nov 2013 07:34:40 -0300
Subject: [PATCH] [media] cx231xx: use after free on error path in probe
We dereference "dev" after it has already been freed.
Signed-off-by: Dan Carpenter <dan.carpen...@oracle.com>
Signed-off-by: Hans Verkuil <hans.verk...@cisco.com>
Cc: stable@vger.kernel.org
Signed-off-by: Mauro Carvalho Chehab <m.che...@samsung.com>
diff --git a/drivers/media/usb/cx231xx/cx231xx-cards.c
b/drivers/media/usb/cx231xx/cx231xx-cards.c
index e9d017bea377..528cce958a82 100644
--- a/drivers/media/usb/cx231xx/cx231xx-cards.c
+++ b/drivers/media/usb/cx231xx/cx231xx-cards.c
@@ -1412,8 +1412,8 @@ err_v4l2:
usb_set_intfdata(interface, NULL);
err_if:
usb_put_dev(udev);
- kfree(dev);
clear_bit(dev->devno, &cx231xx_devused);
+ kfree(dev);
return retval;
}
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
