Commit 6b74705e authored by Dan Carpenter's avatar Dan Carpenter Committed by Greg Kroah-Hartman
Browse files

Staging: Beceem: use after free in bcm_exit() 



We can't call class_destroy() until after the driver has been deregistered.
It leads to a NULL deref on module unload.

Signed-off-by: default avatarDan Carpenter <error27@gmail.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
parent cd0b0ebf

drivers/staging/bcm/InterfaceInit.c

+1 −2
Original line number Diff line number Diff line
@@ -658,9 +658,8 @@ static __init int bcm_init(void) 


static __exit void bcm_exit(void)

{

	class_destroy(bcm_class);



	usb_deregister(&usbbcm_driver);

	class_destroy(bcm_class);

}



module_init(bcm_init);