1 files changed, 21 insertions, 12 deletions

diff --git a/drivers/media/video/soc_camera.c b/drivers/media/video/soc_camera.c
index 59aa7a3694c..95fdeb23c2c 100644
--- a/drivers/media/video/soc_camera.c
+++ b/drivers/media/video/soc_camera.c
@@ -1097,6 +1097,13 @@ static int default_s_crop(struct soc_camera_device *icd, struct v4l2_crop *a)
 	return v4l2_subdev_call(sd, video, s_crop, a);
 }
 
+static void soc_camera_device_init(struct device *dev, void *pdata)
+{
+	dev->platform_data	= pdata;
+	dev->bus		= &soc_camera_bus_type;
+	dev->release		= dummy_release;
+}
+
 int soc_camera_host_register(struct soc_camera_host *ici)
 {
 	struct soc_camera_host *ix;
@@ -1158,15 +1165,19 @@ void soc_camera_host_unregister(struct soc_camera_host *ici)
 
 	list_for_each_entry(icd, &devices, list) {
 		if (icd->iface == ici->nr) {
+			void *pdata = icd->dev.platform_data;
 			/* The bus->remove will be called */
 			device_unregister(&icd->dev);
-			/* Not before device_unregister(), .remove
-			 * needs parent to call ici->ops->remove() */
-			icd->dev.parent = NULL;
-
-			/* If the host module is loaded again, device_register()
-			 * would complain "already initialised" */
-			memset(&icd->dev.kobj, 0, sizeof(icd->dev.kobj));
+			/*
+			 * Not before device_unregister(), .remove
+			 * needs parent to call ici->ops->remove().
+			 * If the host module is loaded again, device_register()
+			 * would complain "already initialised," since 2.6.32
+			 * this is also needed to prevent use-after-free of the
+			 * device private data.
+			 */
+			memset(&icd->dev, 0, sizeof(icd->dev));
+			soc_camera_device_init(&icd->dev, pdata);
 		}
 	}
 
@@ -1198,10 +1209,7 @@ static int soc_camera_device_register(struct soc_camera_device *icd)
 		 * man, stay reasonable... */
 		return -ENOMEM;
 
-	icd->devnum = num;
-	icd->dev.bus = &soc_camera_bus_type;
-
-	icd->dev.release	= dummy_release;
+	icd->devnum		= num;
 	icd->use_count		= 0;
 	icd->host_priv		= NULL;
 	mutex_init(&icd->video_lock);
@@ -1309,12 +1317,13 @@ static int __devinit soc_camera_pdrv_probe(struct platform_device *pdev)
 	icd->iface = icl->bus_id;
 	icd->pdev = &pdev->dev;
 	platform_set_drvdata(pdev, icd);
-	icd->dev.platform_data = icl;
 
 	ret = soc_camera_device_register(icd);
 	if (ret < 0)
 		goto escdevreg;
 
+	soc_camera_device_init(&icd->dev, icl);
+
 	icd->user_width		= DEFAULT_WIDTH;
 	icd->user_height	= DEFAULT_HEIGHT;