diff options
author | Alan Cox <alan@lxorguk.ukuu.org.uk> | 2009-04-22 14:03:15 (GMT) |
---|---|---|
committer | Linus Torvalds <torvalds@linux-foundation.org> | 2009-04-24 14:52:08 (GMT) |
commit | ec5f5bf80501abfe2da2897cfcde8452b545aacb (patch) | |
tree | a2426e9f1b0d288105b6be6fb992a00489f2b204 /drivers/media | |
parent | 79e95eba026944ec3353754f24e316d3aaa209fe (diff) | |
download | linux-ec5f5bf80501abfe2da2897cfcde8452b545aacb.tar.xz |
radio_si470x: Fix free memory corruption
The release path for a disconnected device frees the object then unlocks
the mutex in the freed object...
Found by Dan Carpenter using Smatch
Signed-off-by: Alan Cox <alan@lxorguk.ukuu.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'drivers/media')
-rw-r--r-- | drivers/media/radio/radio-si470x.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/media/radio/radio-si470x.c b/drivers/media/radio/radio-si470x.c index 92c2977..bd945d0 100644 --- a/drivers/media/radio/radio-si470x.c +++ b/drivers/media/radio/radio-si470x.c @@ -1200,7 +1200,7 @@ static int si470x_fops_release(struct file *file) video_unregister_device(radio->videodev); kfree(radio->buffer); kfree(radio); - goto unlock; + goto done; } /* stop rds reception */ |