diff options
author | Alan Cox <alan@lxorguk.ukuu.org.uk> | 2009-04-22 10:03:15 -0400 |
---|---|---|
committer | Linus Torvalds <torvalds@linux-foundation.org> | 2009-04-24 10:52:08 -0400 |
commit | ec5f5bf80501abfe2da2897cfcde8452b545aacb (patch) | |
tree | a2426e9f1b0d288105b6be6fb992a00489f2b204 /drivers/media/radio/radio-si470x.c | |
parent | 79e95eba026944ec3353754f24e316d3aaa209fe (diff) |
radio_si470x: Fix free memory corruption
The release path for a disconnected device frees the object then unlocks
the mutex in the freed object...
Found by Dan Carpenter using Smatch
Signed-off-by: Alan Cox <alan@lxorguk.ukuu.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'drivers/media/radio/radio-si470x.c')
-rw-r--r-- | drivers/media/radio/radio-si470x.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/media/radio/radio-si470x.c b/drivers/media/radio/radio-si470x.c index 92c297796a9f..bd945d04dc90 100644 --- a/drivers/media/radio/radio-si470x.c +++ b/drivers/media/radio/radio-si470x.c | |||
@@ -1200,7 +1200,7 @@ static int si470x_fops_release(struct file *file) | |||
1200 | video_unregister_device(radio->videodev); | 1200 | video_unregister_device(radio->videodev); |
1201 | kfree(radio->buffer); | 1201 | kfree(radio->buffer); |
1202 | kfree(radio); | 1202 | kfree(radio); |
1203 | goto unlock; | 1203 | goto done; |
1204 | } | 1204 | } |
1205 | 1205 | ||
1206 | /* stop rds reception */ | 1206 | /* stop rds reception */ |