diff options
| author | Mauro Carvalho Chehab <mchehab@osg.samsung.com> | 2015-12-10 17:29:22 (GMT) |
|---|---|---|
| committer | Mauro Carvalho Chehab <mchehab@osg.samsung.com> | 2016-01-11 14:18:57 (GMT) |
| commit | eb83a5176801d53f9f78eff8c0bf03e627110206 (patch) | |
| tree | 4c5968691fc4672acf9624cd271abf14f96795ad /drivers/media/media-entity.c | |
| parent | a9709e435454cf84d8971261ff8ded3a453b9b13 (diff) | |
| download | linux-eb83a5176801d53f9f78eff8c0bf03e627110206.tar.xz | |
[media] media-entity: fix backlink removal on __media_entity_remove_link()
The logic is testing if num_links==0 at the wrong place. Due to
that, a backlink may be kept without removal, causing KASAN
to complain about usage after free during either entity or
link removal.
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Diffstat (limited to 'drivers/media/media-entity.c')
| -rw-r--r-- | drivers/media/media-entity.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/drivers/media/media-entity.c b/drivers/media/media-entity.c index d7243cb..d9d42fa 100644 --- a/drivers/media/media-entity.c +++ b/drivers/media/media-entity.c @@ -662,13 +662,13 @@ static void __media_entity_remove_link(struct media_entity *entity, if (link->source->entity == entity) remote->num_backlinks--; - if (--remote->num_links == 0) - break; - /* Remove the remote link */ list_del(&rlink->list); media_gobj_remove(&rlink->graph_obj); kfree(rlink); + + if (--remote->num_links == 0) + break; } list_del(&link->list); media_gobj_remove(&link->graph_obj); |