[media] xc5000: use after free in release()
authorDan Carpenter <dan.carpenter@oracle.com>
Thu, 25 Sep 2014 11:40:08 +0000 (08:40 -0300)
committerMauro Carvalho Chehab <mchehab@osg.samsung.com>
Fri, 24 Oct 2014 11:29:28 +0000 (09:29 -0200)
I moved the call to hybrid_tuner_release_state(priv) after
"priv->firmware" dereference.

Fixes: 5264a522a597 ('[media] media: tuner xc5000 - release firmwware from xc5000_release()')

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Shuah Khan <shuahkh@osg.samsung.com>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
drivers/media/tuners/xc5000.c

index e44c8aba6074c0667181d9e7a7daab2f7db4d1bc..803a0e63d47eef2ee40e1fb1ce7fbec21cd7d9ab 100644 (file)
@@ -1333,9 +1333,9 @@ static int xc5000_release(struct dvb_frontend *fe)
 
        if (priv) {
                cancel_delayed_work(&priv->timer_sleep);
-               hybrid_tuner_release_state(priv);
                if (priv->firmware)
                        release_firmware(priv->firmware);
+               hybrid_tuner_release_state(priv);
        }
 
        mutex_unlock(&xc5000_list_mutex);