summaryrefslogtreecommitdiff
path: root/drivers
diff options
context:
space:
mode:
authorDan Carpenter <error27@gmail.com>2009-02-14 12:53:48 +0300
committerLen Brown <len.brown@intel.com>2009-03-16 07:37:33 +0300
commit013d67fd4f0da8f6af60a376f1a254266ab658ef (patch)
tree0320f708760f39267205dbd00bc1adec3c4856cd /drivers
parentd263da311ab403e3a84fa24920edc826147a550c (diff)
downloadlinux-013d67fd4f0da8f6af60a376f1a254266ab658ef.tar.xz
acer-wmi: double free in acer_rfkill_exit()
This is acer_rfkill_exit() from drivers/platform/x86/acer-wmi.c. The code frees wireless_rfkill->data again instead of bluetooth_rfkill->data. This was found using a code checker (http://repo.or.cz/w/smatch.git/). Signed-off-by: Dan Carpenter <error27@gmail.com> Signed-off-by: Carlos Corbacho <carlos@strangeworlds.co.uk> Signed-off-by: Len Brown <len.brown@intel.com>
Diffstat (limited to 'drivers')
-rw-r--r--drivers/platform/x86/acer-wmi.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c
index 6bcca616a704..a6a42e8c060b 100644
--- a/drivers/platform/x86/acer-wmi.c
+++ b/drivers/platform/x86/acer-wmi.c
@@ -1026,7 +1026,7 @@ static void acer_rfkill_exit(void)
kfree(wireless_rfkill->data);
rfkill_unregister(wireless_rfkill);
if (has_cap(ACER_CAP_BLUETOOTH)) {
- kfree(wireless_rfkill->data);
+ kfree(bluetooth_rfkill->data);
rfkill_unregister(bluetooth_rfkill);
}
return;