[media] em28xx: use after free in em28xx_v4l2_close()
We need to move the unlock before the kfree(dev);
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
diff --git a/drivers/media/usb/em28xx/em28xx-video.c b/drivers/media/usb/em28xx/em28xx-video.c
index ecb23df..78d6ebd 100644
--- a/drivers/media/usb/em28xx/em28xx-video.c
+++ b/drivers/media/usb/em28xx/em28xx-video.c
@@ -2264,9 +2264,9 @@
if (dev->state & DEV_DISCONNECTED) {
em28xx_release_resources(dev);
kfree(dev->alt_max_pkt_size);
+ mutex_unlock(&dev->lock);
kfree(dev);
kfree(fh);
- mutex_unlock(&dev->lock);
return 0;
}