summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorLinus Torvalds <torvalds@linux-foundation.org>2010-10-17 09:38:08 -0700
committerLinus Torvalds <torvalds@linux-foundation.org>2010-10-17 09:38:08 -0700
commit2b666ca4a68cbc22483b0f2e1ba3c0e59b01ae9e (patch)
tree6f5747156465192ba724f79c12f3e06b3bddf4a0
parent2d019713b7acbc01d769a1e512ca1f9a04c30bd0 (diff)
parentaa73aec6c385e2c797ac25cc7ccf0318031de7c8 (diff)
Merge branch 'fix/misc' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6
* 'fix/misc' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6: ALSA: rawmidi: fix oops (use after free) when unloading a driver module
-rw-r--r--sound/core/rawmidi.c4
1 files changed, 3 insertions, 1 deletions
diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c
index a7868ad4d530..cbbed0db9e56 100644
--- a/sound/core/rawmidi.c
+++ b/sound/core/rawmidi.c
@@ -535,13 +535,15 @@ static int snd_rawmidi_release(struct inode *inode, struct file *file)
{
struct snd_rawmidi_file *rfile;
struct snd_rawmidi *rmidi;
+ struct module *module;
rfile = file->private_data;
rmidi = rfile->rmidi;
rawmidi_release_priv(rfile);
kfree(rfile);
+ module = rmidi->card->module;
snd_card_file_remove(rmidi->card, file);
- module_put(rmidi->card->module);
+ module_put(module);
return 0;
}