aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorDan Carpenter <error27@gmail.com>2009-12-01 16:17:41 -0500
committerLinus Torvalds <torvalds@linux-foundation.org>2009-12-01 19:32:19 -0500
commitfa00e106eb6f082654d822a0946c0c86297ede2c (patch)
treef176cc90a568182419de69c555c25f9c2459a188
parent4c4cb1b1605e50983afd7924980c9434b214599f (diff)
drivers/rtc/rtc-pcf50633.c: fix use after free in pcf50633_rtc_probe()
"rtc" is freed and then dereferenced on the next line. This patch fixes that. Signed-off-by: Dan Carpenter <error27@gmail.com> Acked-by: Alessandro Zummo <a.zummo@towertech.it> Cc: David Brownell <david-b@pacbell.net> Cc: Paul Gortmaker <p_gortmaker@yahoo.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
-rw-r--r--drivers/rtc/rtc-pcf50633.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/rtc/rtc-pcf50633.c b/drivers/rtc/rtc-pcf50633.c
index 33a10c47260e..4c5d5d0c4cfc 100644
--- a/drivers/rtc/rtc-pcf50633.c
+++ b/drivers/rtc/rtc-pcf50633.c
@@ -292,8 +292,9 @@ static int __devinit pcf50633_rtc_probe(struct platform_device *pdev)
292 &pcf50633_rtc_ops, THIS_MODULE); 292 &pcf50633_rtc_ops, THIS_MODULE);
293 293
294 if (IS_ERR(rtc->rtc_dev)) { 294 if (IS_ERR(rtc->rtc_dev)) {
295 int ret = PTR_ERR(rtc->rtc_dev);
295 kfree(rtc); 296 kfree(rtc);
296 return PTR_ERR(rtc->rtc_dev); 297 return ret;
297 } 298 }
298 299
299 pcf50633_register_irq(rtc->pcf, PCF50633_IRQ_ALARM, 300 pcf50633_register_irq(rtc->pcf, PCF50633_IRQ_ALARM,