diff options
| author | Mauro Carvalho Chehab <mchehab@redhat.com> | 2009-04-29 16:34:27 -0300 |
|---|---|---|
| committer | Mauro Carvalho Chehab <mchehab@redhat.com> | 2009-04-29 16:34:27 -0300 |
| commit | f9276b4928a4076ff0e5478e1e5687a77d95db7d (patch) | |
| tree | 8c81d295c0a2fda54723f3290690bbb5c6336eca /linux | |
| parent | b5e0dd199b05b5421725d31127d8d6635ded476b (diff) | |
| download | mediapointer-dvb-s2-f9276b4928a4076ff0e5478e1e5687a77d95db7d.tar.gz mediapointer-dvb-s2-f9276b4928a4076ff0e5478e1e5687a77d95db7d.tar.bz2 | |
backport commit ec5f5bf80501abfe2da2897cfcde8452b545aacb
From: Mauro Carvalho Chehab <mchehab@redhat.com>
kernel-sync:
Author: Alan Cox <alan@lxorguk.ukuu.org.uk>
Date: Wed Apr 22 15:03:15 2009 +0100
radio_si470x: Fix free memory corruption
The release path for a disconnected device frees the object then unlocks
the mutex in the freed object...
Found by Dan Carpenter using Smatch
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Diffstat (limited to 'linux')
| -rw-r--r-- | linux/drivers/media/radio/radio-si470x.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/linux/drivers/media/radio/radio-si470x.c b/linux/drivers/media/radio/radio-si470x.c index b4d6641b4..f78a9cdea 100644 --- a/linux/drivers/media/radio/radio-si470x.c +++ b/linux/drivers/media/radio/radio-si470x.c @@ -1201,7 +1201,7 @@ static int si470x_fops_release(struct file *file) video_unregister_device(radio->videodev); kfree(radio->buffer); kfree(radio); - goto unlock; + goto done; } /* stop rds reception */ |