V4L/DVB (3790): Use after free in drivers/media/video/em28xx/em28xx-video.c

In several places we use dev->devno right after we kfree() dev.  This fixes
coverity bug id #1065

Signed-off-by: Eric Sesterhenn <snakebyte@gmx.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>

1 files changed, 5 insertions, 5 deletions

diff --git a/drivers/media/video/em28xx/em28xx-video.c b/drivers/media/video/em28xx/em28xx-video.c
index ddc92cbb5276..cf7cdf9ef617 100644
--- a/drivers/media/video/em28xx/em28xx-video.c
+++ b/drivers/media/video/em28xx/em28xx-video.c
@@ -1576,8 +1576,8 @@ static int em28xx_init_dev(struct em28xx **devhandle, struct usb_device *udev,
         errCode = em28xx_config(dev);
         if (errCode) {
                 em28xx_errdev("error configuring device\n");
-                kfree(dev);
                 em28xx_devused&=~(1<<dev->devno);
+                kfree(dev);
                 return -ENOMEM;
         }
 
@@ -1603,8 +1603,8 @@ static int em28xx_init_dev(struct em28xx **devhandle, struct usb_device *udev,
         dev->vdev = video_device_alloc();
         if (NULL == dev->vdev) {
                 em28xx_errdev("cannot allocate video_device.\n");
-                kfree(dev);
                 em28xx_devused&=~(1<<dev->devno);
+                kfree(dev);
                 return -ENOMEM;
         }
 
@@ -1612,8 +1612,8 @@ static int em28xx_init_dev(struct em28xx **devhandle, struct usb_device *udev,
         if (NULL == dev->vbi_dev) {
                 em28xx_errdev("cannot allocate video_device.\n");
                 kfree(dev->vdev);
-                kfree(dev);
                 em28xx_devused&=~(1<<dev->devno);
+                kfree(dev);
                 return -ENOMEM;
         }
 
@@ -1650,8 +1650,8 @@ static int em28xx_init_dev(struct em28xx **devhandle, struct usb_device *udev,
                 mutex_unlock(&dev->lock);
                 list_del(&dev->devlist);
                 video_device_release(dev->vdev);
-                kfree(dev);
                 em28xx_devused&=~(1<<dev->devno);
+                kfree(dev);
                 return -ENODEV;
         }
 
@@ -1662,8 +1662,8 @@ static int em28xx_init_dev(struct em28xx **devhandle, struct usb_device *udev,
                 list_del(&dev->devlist);
                 video_device_release(dev->vbi_dev);
                 video_device_release(dev->vdev);
-                kfree(dev);
                 em28xx_devused&=~(1<<dev->devno);
+                kfree(dev);
                 return -ENODEV;
         } else {
                 printk("registered VBI\n");