提交 ec5f5bf8 编写于 作者: A Alan Cox 提交者: Linus Torvalds

radio_si470x: Fix free memory corruption

The release path for a disconnected device frees the object then unlocks
the mutex in the freed object...

Found by Dan Carpenter using Smatch
Signed-off-by: NAlan Cox <alan@lxorguk.ukuu.org.uk>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
上级 79e95eba
...@@ -1200,7 +1200,7 @@ static int si470x_fops_release(struct file *file) ...@@ -1200,7 +1200,7 @@ static int si470x_fops_release(struct file *file)
video_unregister_device(radio->videodev); video_unregister_device(radio->videodev);
kfree(radio->buffer); kfree(radio->buffer);
kfree(radio); kfree(radio);
goto unlock; goto done;
} }
/* stop rds reception */ /* stop rds reception */
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册