media: video-i2c: avoid accessing released memory area when removing driver

[linux.git] / drivers / media / i2c / video-i2c.c

diff --git a/drivers/media/i2c/video-i2c.c b/drivers/media/i2c/video-i2c.c
index 06d29d8f6be8ed8e7cb7c7418c58643e6a9eda58..ec0758dca2fcdcf1f01e228eb42f8acfb2d9d089 100644 (file)
--- a/drivers/media/i2c/video-i2c.c
+++ b/drivers/media/i2c/video-i2c.c
@@ -352,8 +352,8 @@ static int video_i2c_querycap(struct file *file, void  *priv,
        struct video_i2c_data *data = video_drvdata(file);
        struct i2c_client *client = data->client;
 
-       strlcpy(vcap->driver, data->v4l2_dev.name, sizeof(vcap->driver));
-       strlcpy(vcap->card, data->vdev.name, sizeof(vcap->card));
+       strscpy(vcap->driver, data->v4l2_dev.name, sizeof(vcap->driver));
+       strscpy(vcap->card, data->vdev.name, sizeof(vcap->card));
 
        sprintf(vcap->bus_info, "I2C:%d-%d", client->adapter->nr, client->addr);
 
@@ -378,7 +378,7 @@ static int video_i2c_enum_input(struct file *file, void *fh,
        if (vin->index > 0)
                return -EINVAL;
 
-       strlcpy(vin->name, "Camera", sizeof(vin->name));
+       strscpy(vin->name, "Camera", sizeof(vin->name));
 
        vin->type = V4L2_INPUT_TYPE_CAMERA;
 
@@ -510,7 +510,12 @@ static const struct v4l2_ioctl_ops video_i2c_ioctl_ops = {
 
 static void video_i2c_release(struct video_device *vdev)
 {
-       kfree(video_get_drvdata(vdev));
+       struct video_i2c_data *data = video_get_drvdata(vdev);
+
+       v4l2_device_unregister(&data->v4l2_dev);
+       mutex_destroy(&data->lock);
+       mutex_destroy(&data->queue_lock);
+       kfree(data);
 }
 
 static int video_i2c_probe(struct i2c_client *client,
@@ -534,7 +539,7 @@ static int video_i2c_probe(struct i2c_client *client,
 
        data->client = client;
        v4l2_dev = &data->v4l2_dev;
-       strlcpy(v4l2_dev->name, VIDEO_I2C_DRIVER, sizeof(v4l2_dev->name));
+       strscpy(v4l2_dev->name, VIDEO_I2C_DRIVER, sizeof(v4l2_dev->name));
 
        ret = v4l2_device_register(&client->dev, v4l2_dev);
        if (ret < 0)
@@ -608,10 +613,6 @@ static int video_i2c_remove(struct i2c_client *client)
        struct video_i2c_data *data = i2c_get_clientdata(client);
 
        video_unregister_device(&data->vdev);
-       v4l2_device_unregister(&data->v4l2_dev);
-
-       mutex_destroy(&data->lock);
-       mutex_destroy(&data->queue_lock);
 
        return 0;
 }