diff options
| author | Lee Jones <lee.jones@linaro.org> | 2020-02-03 16:21:30 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2020-02-05 16:03:41 +0300 |
| commit | 0406d59c89c88f6e636ac2c70fc36adf893f0c18 (patch) | |
| tree | 2e30bd3e6b6e2732abd12bf2b829c0dbf59e14a4 /drivers | |
| parent | 1da25d34b29b0640f83e0720ec2eb100c4d2c333 (diff) | |
| download | linux-0406d59c89c88f6e636ac2c70fc36adf893f0c18.tar.xz | |
media: si470x-i2c: Move free() past last use of 'radio'
A pointer to 'struct si470x_device' is currently used after free:
drivers/media/radio/si470x/radio-si470x-i2c.c:462:25-30: ERROR: reference
preceded by free on line 460
Shift the call to free() down past its final use.
NB: Not sending to Mainline, since the problem does not exist there, it was
caused by the backport of 2df200ab234a ("media: si470x-i2c: add missed
operations in remove") to the stable trees.
Cc: <stable@vger.kernel.org> # v3.18+
Reported-by: kbuild test robot <lkp@intel.com>
Reported-by: Julia Lawall <julia.lawall@lip6.fr>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/media/radio/si470x/radio-si470x-i2c.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/media/radio/si470x/radio-si470x-i2c.c b/drivers/media/radio/si470x/radio-si470x-i2c.c index f9e1768b8d31..0836fa442d22 100644 --- a/drivers/media/radio/si470x/radio-si470x-i2c.c +++ b/drivers/media/radio/si470x/radio-si470x-i2c.c @@ -458,10 +458,10 @@ static int si470x_i2c_remove(struct i2c_client *client) free_irq(client->irq, radio); video_unregister_device(&radio->videodev); - kfree(radio); v4l2_ctrl_handler_free(&radio->hdl); v4l2_device_unregister(&radio->v4l2_dev); + kfree(radio); return 0; } |