diff options
| author | Darren Jenkins <darrenrjenkins@gmail.com> | 2010-02-11 14:07:53 +0300 |
|---|---|---|
| committer | Mauro Carvalho Chehab <mchehab@redhat.com> | 2010-02-26 21:10:58 +0300 |
| commit | 96dd6de3d058a454a5bc4ce2f561a053dd90bfae (patch) | |
| tree | e8f82d9a4febc12102705d3572480eb77a686004 /drivers | |
| parent | 8ef4c21130832cb51d5a5940ad3d4b7140720218 (diff) | |
| download | linux-96dd6de3d058a454a5bc4ce2f561a053dd90bfae.tar.xz | |
V4L/DVB: drivers/media/radio/si470x/radio-si470x-usb.c fix use after free
In si470x_usb_driver_disconnect() radio->disconnect_lock is accessed
after it is freed. This fixes the problem.
Coverity CID: 2530
Signed-off-by: Darren Jenkins <darrenrjenkins@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/media/radio/si470x/radio-si470x-usb.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/media/radio/si470x/radio-si470x-usb.c b/drivers/media/radio/si470x/radio-si470x-usb.c index a0a79c70dd5b..6f60841828da 100644 --- a/drivers/media/radio/si470x/radio-si470x-usb.c +++ b/drivers/media/radio/si470x/radio-si470x-usb.c @@ -842,9 +842,11 @@ static void si470x_usb_driver_disconnect(struct usb_interface *intf) kfree(radio->int_in_buffer); video_unregister_device(radio->videodev); kfree(radio->buffer); + mutex_unlock(&radio->disconnect_lock); kfree(radio); + } else { + mutex_unlock(&radio->disconnect_lock); } - mutex_unlock(&radio->disconnect_lock); } |