aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorDan Carpenter <error27@gmail.com>2009-02-14 04:53:48 -0500
committerLen Brown <len.brown@intel.com>2009-03-16 00:37:33 -0400
commit013d67fd4f0da8f6af60a376f1a254266ab658ef (patch)
tree0320f708760f39267205dbd00bc1adec3c4856cd
parentd263da311ab403e3a84fa24920edc826147a550c (diff)
acer-wmi: double free in acer_rfkill_exit()
This is acer_rfkill_exit() from drivers/platform/x86/acer-wmi.c. The code frees wireless_rfkill->data again instead of bluetooth_rfkill->data. This was found using a code checker (http://repo.or.cz/w/smatch.git/). Signed-off-by: Dan Carpenter <error27@gmail.com> Signed-off-by: Carlos Corbacho <carlos@strangeworlds.co.uk> Signed-off-by: Len Brown <len.brown@intel.com>
-rw-r--r--drivers/platform/x86/acer-wmi.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c
index 6bcca616a704..a6a42e8c060b 100644
--- a/drivers/platform/x86/acer-wmi.c
+++ b/drivers/platform/x86/acer-wmi.c
@@ -1026,7 +1026,7 @@ static void acer_rfkill_exit(void)
1026 kfree(wireless_rfkill->data); 1026 kfree(wireless_rfkill->data);
1027 rfkill_unregister(wireless_rfkill); 1027 rfkill_unregister(wireless_rfkill);
1028 if (has_cap(ACER_CAP_BLUETOOTH)) { 1028 if (has_cap(ACER_CAP_BLUETOOTH)) {
1029 kfree(wireless_rfkill->data); 1029 kfree(bluetooth_rfkill->data);
1030 rfkill_unregister(bluetooth_rfkill); 1030 rfkill_unregister(bluetooth_rfkill);
1031 } 1031 }
1032 return; 1032 return;