From f9276b4928a4076ff0e5478e1e5687a77d95db7d Mon Sep 17 00:00:00 2001 From: Mauro Carvalho Chehab Date: Wed, 29 Apr 2009 16:34:27 -0300 Subject: backport commit ec5f5bf80501abfe2da2897cfcde8452b545aacb From: Mauro Carvalho Chehab kernel-sync: Author: Alan Cox Date: Wed Apr 22 15:03:15 2009 +0100 radio_si470x: Fix free memory corruption The release path for a disconnected device frees the object then unlocks the mutex in the freed object... Found by Dan Carpenter using Smatch Signed-off-by: Mauro Carvalho Chehab --- linux/drivers/media/radio/radio-si470x.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'linux') diff --git a/linux/drivers/media/radio/radio-si470x.c b/linux/drivers/media/radio/radio-si470x.c index b4d6641b4..f78a9cdea 100644 --- a/linux/drivers/media/radio/radio-si470x.c +++ b/linux/drivers/media/radio/radio-si470x.c @@ -1201,7 +1201,7 @@ static int si470x_fops_release(struct file *file) video_unregister_device(radio->videodev); kfree(radio->buffer); kfree(radio); - goto unlock; + goto done; } /* stop rds reception */ -- cgit v1.2.3