[PATCH] v4l use-after-free fix

From: Greg KH <greg@kroah.com>

When working on converting the usb v4l drivers to the new v4l class
changes, I ran into this nasty bug.  Seems that the core was using a
structure after it had been freed.  The patch below fixes it.

diff --git a/drivers/media/video/videodev.c b/drivers/media/video/videodev.c
index 91a7970e93895935f39b1062ca38bf540531cab8..777f59a1f6c90727d79eda7eb07f34f399956a48 100644 (file)
--- a/drivers/media/video/videodev.c
+++ b/drivers/media/video/videodev.c
@@ -349,9 +349,9 @@ void video_unregister_device(struct video_device *vfd)
        if(video_device[vfd->minor]!=vfd)
                panic("videodev: bad unregister");
 
-       class_device_unregister(&vfd->class_dev);
        devfs_remove(vfd->devfs_name);
        video_device[vfd->minor]=NULL;
+       class_device_unregister(&vfd->class_dev);
        up(&videodev_lock);
 }