[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-Id: <20200203132130.12748-1-lee.jones@linaro.org>
Date: Mon, 3 Feb 2020 13:21:30 +0000
From: Lee Jones <lee.jones@...aro.org>
To: stable@...r.kernel.org
Cc: linux-arm-kernel@...ts.infradead.org, linux-kernel@...r.kernel.org
Subject: [PATCH 1/1] media: si470x-i2c: Move free() past last use of 'radio'
A pointer to 'struct si470x_device' is currently used after free:
drivers/media/radio/si470x/radio-si470x-i2c.c:462:25-30: ERROR: reference
preceded by free on line 460
Shift the call to free() down past its final use.
NB: Not sending to Mainline, since the problem does not exist there.
Cc: <stable@...r.kernel.org> # v3.18+
Reported-by: kbuild test robot <lkp@...el.com>
Reported-by: Julia Lawall <julia.lawall@...6.fr>
Signed-off-by: Lee Jones <lee.jones@...aro.org>
---
drivers/media/radio/si470x/radio-si470x-i2c.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/radio/si470x/radio-si470x-i2c.c b/drivers/media/radio/si470x/radio-si470x-i2c.c
index ae7540b765e1d..aa12fd2663895 100644
--- a/drivers/media/radio/si470x/radio-si470x-i2c.c
+++ b/drivers/media/radio/si470x/radio-si470x-i2c.c
@@ -483,10 +483,10 @@ static int si470x_i2c_remove(struct i2c_client *client)
free_irq(client->irq, radio);
video_unregister_device(&radio->videodev);
- kfree(radio);
v4l2_ctrl_handler_free(&radio->hdl);
v4l2_device_unregister(&radio->v4l2_dev);
+ kfree(radio);
return 0;
}
--
2.24.0
Powered by blists - more mailing lists