aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/media/pci/ttpci/av7110_hw.c
diff options
context:
space:
mode:
authorArnd Bergmann <arnd@arndb.de>2017-02-02 12:36:01 -0200
committerMauro Carvalho Chehab <mchehab@s-opensource.com>2017-02-08 11:45:09 -0200
commit005145378c9ad7575a01b6ce1ba118fb427f583a (patch)
treecbc6fb8c207d5f7dbc163819bd8d42a65504fb5b /drivers/media/pci/ttpci/av7110_hw.c
parent430ae1261c511efe9fc6293fbf24b1f71ea8c4ea (diff)
[media] dvb-usb-v2: avoid use-after-free
I ran into a stack frame size warning because of the on-stack copy of the USB device structure: drivers/media/usb/dvb-usb-v2/dvb_usb_core.c: In function 'dvb_usbv2_disconnect': drivers/media/usb/dvb-usb-v2/dvb_usb_core.c:1029:1: error: the frame size of 1104 bytes is larger than 1024 bytes [-Werror=frame-larger-than=] Copying a device structure like this is wrong for a number of other reasons too aside from the possible stack overflow. One of them is that the dev_info() call will print the name of the device later, but AFAICT we have only copied a pointer to the name earlier and the actual name has been freed by the time it gets printed. This removes the on-stack copy of the device and instead copies the device name using kstrdup(). I'm ignoring the possible failure here as both printk() and kfree() are able to deal with NULL pointers. Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Diffstat (limited to 'drivers/media/pci/ttpci/av7110_hw.c')
0 files changed, 0 insertions, 0 deletions

Privacy Policy