diff options
| author | Darren Jenkins <darrenrjenkins@gmail.com> | 2010-02-11 08:07:53 -0300 |
|---|---|---|
| committer | Mauro Carvalho Chehab <mchehab@redhat.com> | 2010-02-26 15:10:58 -0300 |
| commit | 96dd6de3d058a454a5bc4ce2f561a053dd90bfae (patch) | |
| tree | e8f82d9a4febc12102705d3572480eb77a686004 /drivers/media/radio | |
| parent | 8ef4c21130832cb51d5a5940ad3d4b7140720218 (diff) | |
| download | op-kernel-dev-96dd6de3d058a454a5bc4ce2f561a053dd90bfae.zip op-kernel-dev-96dd6de3d058a454a5bc4ce2f561a053dd90bfae.tar.gz | |
V4L/DVB: drivers/media/radio/si470x/radio-si470x-usb.c fix use after free
In si470x_usb_driver_disconnect() radio->disconnect_lock is accessed
after it is freed. This fixes the problem.
Coverity CID: 2530
Signed-off-by: Darren Jenkins <darrenrjenkins@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Diffstat (limited to 'drivers/media/radio')
| -rw-r--r-- | drivers/media/radio/si470x/radio-si470x-usb.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/media/radio/si470x/radio-si470x-usb.c b/drivers/media/radio/si470x/radio-si470x-usb.c index a0a79c7..6f60841 100644 --- a/drivers/media/radio/si470x/radio-si470x-usb.c +++ b/drivers/media/radio/si470x/radio-si470x-usb.c @@ -842,9 +842,11 @@ static void si470x_usb_driver_disconnect(struct usb_interface *intf) kfree(radio->int_in_buffer); video_unregister_device(radio->videodev); kfree(radio->buffer); + mutex_unlock(&radio->disconnect_lock); kfree(radio); + } else { + mutex_unlock(&radio->disconnect_lock); } - mutex_unlock(&radio->disconnect_lock); } |
