diff options
| author | Oliver Neukum <oneukum@suse.com> | 2022-05-12 14:38:47 +0200 |
|---|---|---|
| committer | Mauro Carvalho Chehab <mchehab@kernel.org> | 2022-06-20 11:30:33 +0200 |
| commit | 522f1d7d95fea3238c777148d95c1d793afa40c2 (patch) | |
| tree | 36a5dae478c34bb5aa92d84191c8b650f2175d4f /drivers/media/rc | |
| parent | media: igorplugusb: respect DMA coherency (diff) | |
| download | linux-522f1d7d95fea3238c777148d95c1d793afa40c2.tar.xz linux-522f1d7d95fea3238c777148d95c1d793afa40c2.zip | |
media: igorplugusb: prevent use after free in probe error
The timer uses the URB. Free it only after the timer
has been stopped.
Signed-off-by: Oliver Neukum <oneukum@suse.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Diffstat (limited to 'drivers/media/rc')
| -rw-r--r-- | drivers/media/rc/igorplugusb.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/media/rc/igorplugusb.c b/drivers/media/rc/igorplugusb.c index b46362da8623..1afba95409ff 100644 --- a/drivers/media/rc/igorplugusb.c +++ b/drivers/media/rc/igorplugusb.c @@ -223,9 +223,9 @@ static int igorplugusb_probe(struct usb_interface *intf, return 0; fail: - rc_free_device(ir->rc); - usb_free_urb(ir->urb); del_timer(&ir->timer); + usb_free_urb(ir->urb); + rc_free_device(ir->rc); kfree(ir->buf_in); return ret; |