diff options
author | Dan Carpenter <error27@gmail.com> | 2009-12-01 16:17:41 -0500 |
---|---|---|
committer | Linus Torvalds <torvalds@linux-foundation.org> | 2009-12-01 19:32:19 -0500 |
commit | fa00e106eb6f082654d822a0946c0c86297ede2c (patch) | |
tree | f176cc90a568182419de69c555c25f9c2459a188 | |
parent | 4c4cb1b1605e50983afd7924980c9434b214599f (diff) |
drivers/rtc/rtc-pcf50633.c: fix use after free in pcf50633_rtc_probe()
"rtc" is freed and then dereferenced on the next line. This patch fixes
that.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Acked-by: Alessandro Zummo <a.zummo@towertech.it>
Cc: David Brownell <david-b@pacbell.net>
Cc: Paul Gortmaker <p_gortmaker@yahoo.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
-rw-r--r-- | drivers/rtc/rtc-pcf50633.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/rtc/rtc-pcf50633.c b/drivers/rtc/rtc-pcf50633.c index 33a10c47260e..4c5d5d0c4cfc 100644 --- a/drivers/rtc/rtc-pcf50633.c +++ b/drivers/rtc/rtc-pcf50633.c | |||
@@ -292,8 +292,9 @@ static int __devinit pcf50633_rtc_probe(struct platform_device *pdev) | |||
292 | &pcf50633_rtc_ops, THIS_MODULE); | 292 | &pcf50633_rtc_ops, THIS_MODULE); |
293 | 293 | ||
294 | if (IS_ERR(rtc->rtc_dev)) { | 294 | if (IS_ERR(rtc->rtc_dev)) { |
295 | int ret = PTR_ERR(rtc->rtc_dev); | ||
295 | kfree(rtc); | 296 | kfree(rtc); |
296 | return PTR_ERR(rtc->rtc_dev); | 297 | return ret; |
297 | } | 298 | } |
298 | 299 | ||
299 | pcf50633_register_irq(rtc->pcf, PCF50633_IRQ_ALARM, | 300 | pcf50633_register_irq(rtc->pcf, PCF50633_IRQ_ALARM, |