projects / GitHub / exynos8895 / android_kernel_samsung_universal8895.git / commitdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | patch | inline | side by side (parent: 79e95eb)
radio_si470x: Fix free memory corruption
authorAlan Cox <alan@lxorguk.ukuu.org.uk>
Wed, 22 Apr 2009 14:03:15 +0000 (15:03 +0100)
committerLinus Torvalds <torvalds@linux-foundation.org>
Fri, 24 Apr 2009 14:52:08 +0000 (07:52 -0700)
The release path for a disconnected device frees the object then unlocks
the mutex in the freed object...

Found by Dan Carpenter using Smatch

Signed-off-by: Alan Cox <alan@lxorguk.ukuu.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
drivers/media/radio/radio-si470x.c patch | blob | blame | history

diff --git a/drivers/media/radio/radio-si470x.c b/drivers/media/radio/radio-si470x.c
index 92c297796a9fd25eb00355072409f45a6a778600..bd945d04dc90cb095e9550c6572aeb32502c2792 100644 (file)
--- a/drivers/media/radio/radio-si470x.c
+++ b/drivers/media/radio/radio-si470x.c
@@ -1200,7 +1200,7 @@ static int si470x_fops_release(struct file *file)
                        video_unregister_device(radio->videodev);
                        kfree(radio->buffer);
                        kfree(radio);
-                       goto unlock;
+                       goto done;
                }
 
                /* stop rds reception */