diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2010-10-17 09:38:08 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2010-10-17 09:38:08 -0700 |
| commit | 2b666ca4a68cbc22483b0f2e1ba3c0e59b01ae9e (patch) | |
| tree | 6f5747156465192ba724f79c12f3e06b3bddf4a0 | |
| parent | 2d019713b7acbc01d769a1e512ca1f9a04c30bd0 (diff) | |
| parent | aa73aec6c385e2c797ac25cc7ccf0318031de7c8 (diff) | |
Merge branch 'fix/misc' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6
* 'fix/misc' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6:
ALSA: rawmidi: fix oops (use after free) when unloading a driver module
| -rw-r--r-- | sound/core/rawmidi.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c index a7868ad4d530..cbbed0db9e56 100644 --- a/sound/core/rawmidi.c +++ b/sound/core/rawmidi.c @@ -535,13 +535,15 @@ static int snd_rawmidi_release(struct inode *inode, struct file *file) { struct snd_rawmidi_file *rfile; struct snd_rawmidi *rmidi; + struct module *module; rfile = file->private_data; rmidi = rfile->rmidi; rawmidi_release_priv(rfile); kfree(rfile); + module = rmidi->card->module; snd_card_file_remove(rmidi->card, file); - module_put(rmidi->card->module); + module_put(module); return 0; } |