Staging: Beceem: use after free in bcm_exit()
authorDan Carpenter <error27@gmail.com>
Mon, 6 Dec 2010 07:02:55 +0000 (10:02 +0300)
committerGreg Kroah-Hartman <gregkh@suse.de>
Tue, 7 Dec 2010 00:09:45 +0000 (16:09 -0800)
We can't call class_destroy() until after the driver has been deregistered.
It leads to a NULL deref on module unload.

Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
drivers/staging/bcm/InterfaceInit.c

index dd829409a8c848618dafcea91ae89d0afab99fc7..b4d22562d0601f7ecfb30f203ee826701c727561 100644 (file)
@@ -658,9 +658,8 @@ static __init int bcm_init(void)
 
 static __exit void bcm_exit(void)
 {
-       class_destroy(bcm_class);
-
        usb_deregister(&usbbcm_driver);
+       class_destroy(bcm_class);
 }
 
 module_init(bcm_init);