Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753522Ab0BKLIG (ORCPT ); Thu, 11 Feb 2010 06:08:06 -0500 Received: from mail-gx0-f224.google.com ([209.85.217.224]:60174 "EHLO mail-gx0-f224.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753300Ab0BKLIA (ORCPT ); Thu, 11 Feb 2010 06:08:00 -0500 DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=subject:from:to:cc:content-type:date:message-id:mime-version :x-mailer:content-transfer-encoding; b=CHVP2nLPyr6Eyo4Fj/vIMsBu0hjOJ+/uVtJeviGp4WbLKcLzBdShKhYgLlYdr7ccoK dglQ6Pm23jCDJW2dZsip1W1pZUzYMfLJ9aZuBLUoBmGc5Fl9yZSkmYbq0caXW3wmZOd1 vFoR3G6OEB1frL1umbho9qF24l8KSv8sI6kiU= Subject: [PATCH] drivers/media/radio/si470x/radio-si470x-usb.c fix use after free From: Darren Jenkins To: Mauro Carvalho Chehab Cc: Tobias Lorenz , Tobias Lorenz , Douglas Schilling Landgraf , linux-media@vger.kernel.org, Linux Kernel Mailing List , Kernel Janitors Content-Type: text/plain; charset="UTF-8" Date: Thu, 11 Feb 2010 22:07:53 +1100 Message-ID: <1265886473.27789.6.camel@ICE-BOX> Mime-Version: 1.0 X-Mailer: Evolution 2.28.1 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1161 Lines: 37 In si470x_usb_driver_disconnect() radio->disconnect_lock is accessed after it is freed. This fixes the problem. Coverity CID: 2530 Signed-off-by: Darren Jenkins --- drivers/media/radio/si470x/radio-si470x-usb.c | 4 +++- 1 files changed, 3 insertions(+), 1 deletions(-) diff --git a/drivers/media/radio/si470x/radio-si470x-usb.c b/drivers/media/radio/si470x/radio-si470x-usb.c index a96e1b9..1588a9d 100644 --- a/drivers/media/radio/si470x/radio-si470x-usb.c +++ b/drivers/media/radio/si470x/radio-si470x-usb.c @@ -842,9 +842,11 @@ static void si470x_usb_driver_disconnect(struct usb_interface *intf) kfree(radio->int_in_buffer); video_unregister_device(radio->videodev); kfree(radio->buffer); + mutex_unlock(&radio->disconnect_lock); kfree(radio); + } else { + mutex_unlock(&radio->disconnect_lock); } - mutex_unlock(&radio->disconnect_lock); } -- 1.6.3.3 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/