diff options
| author | Alan Cox <alan@lxorguk.ukuu.org.uk> | 2009-04-22 15:03:15 +0100 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2009-04-24 07:52:08 -0700 |
| commit | ec5f5bf80501abfe2da2897cfcde8452b545aacb (patch) | |
| tree | a2426e9f1b0d288105b6be6fb992a00489f2b204 /drivers/media/radio/radio-si470x.c | |
| parent | 79e95eba026944ec3353754f24e316d3aaa209fe (diff) | |
| download | op-kernel-dev-ec5f5bf80501abfe2da2897cfcde8452b545aacb.zip op-kernel-dev-ec5f5bf80501abfe2da2897cfcde8452b545aacb.tar.gz | |
radio_si470x: Fix free memory corruption
The release path for a disconnected device frees the object then unlocks
the mutex in the freed object...
Found by Dan Carpenter using Smatch
Signed-off-by: Alan Cox <alan@lxorguk.ukuu.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'drivers/media/radio/radio-si470x.c')
| -rw-r--r-- | drivers/media/radio/radio-si470x.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/media/radio/radio-si470x.c b/drivers/media/radio/radio-si470x.c index 92c2977..bd945d0 100644 --- a/drivers/media/radio/radio-si470x.c +++ b/drivers/media/radio/radio-si470x.c @@ -1200,7 +1200,7 @@ static int si470x_fops_release(struct file *file) video_unregister_device(radio->videodev); kfree(radio->buffer); kfree(radio); - goto unlock; + goto done; } /* stop rds reception */ |
