mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-26 10:49:33 +00:00
[media] media-entity: fix backlink removal on __media_entity_remove_link()
The logic is testing if num_links==0 at the wrong place. Due to that, a backlink may be kept without removal, causing KASAN to complain about usage after free during either entity or link removal. Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
This commit is contained in:
parent
a9709e4354
commit
eb83a51768
1 changed files with 3 additions and 3 deletions
|
@ -662,13 +662,13 @@ static void __media_entity_remove_link(struct media_entity *entity,
|
|||
if (link->source->entity == entity)
|
||||
remote->num_backlinks--;
|
||||
|
||||
if (--remote->num_links == 0)
|
||||
break;
|
||||
|
||||
/* Remove the remote link */
|
||||
list_del(&rlink->list);
|
||||
media_gobj_remove(&rlink->graph_obj);
|
||||
kfree(rlink);
|
||||
|
||||
if (--remote->num_links == 0)
|
||||
break;
|
||||
}
|
||||
list_del(&link->list);
|
||||
media_gobj_remove(&link->graph_obj);
|
||||
|
|
Loading…
Reference in a new issue