From 6b74705e15d5c87181008f1ac984df7faaad55c9 Mon Sep 17 00:00:00 2001 From: Dan Carpenter Date: Mon, 6 Dec 2010 10:02:55 +0300 Subject: Staging: Beceem: use after free in bcm_exit() We can't call class_destroy() until after the driver has been deregistered. It leads to a NULL deref on module unload. Signed-off-by: Dan Carpenter Signed-off-by: Greg Kroah-Hartman --- drivers/staging/bcm/InterfaceInit.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) (limited to 'drivers/staging/bcm') diff --git a/drivers/staging/bcm/InterfaceInit.c b/drivers/staging/bcm/InterfaceInit.c index dd829409a8c8..b4d22562d060 100644 --- a/drivers/staging/bcm/InterfaceInit.c +++ b/drivers/staging/bcm/InterfaceInit.c @@ -658,9 +658,8 @@ static __init int bcm_init(void) static __exit void bcm_exit(void) { - class_destroy(bcm_class); - usb_deregister(&usbbcm_driver); + class_destroy(bcm_class); } module_init(bcm_init); -- cgit v1.2.3