diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2014-09-25 13:40:08 +0200 |
|---|---|---|
| committer | Mauro Carvalho Chehab <mchehab@osg.samsung.com> | 2014-10-24 13:29:28 +0200 |
| commit | 4961a5323f5d873e2170c5ef4f48538930e6df3e (patch) | |
| tree | 351ce7b3b1490dc7b97268d85b2d6f5061923086 /drivers/media | |
| parent | [media] em28xx-input: NULL dereference on error (diff) | |
| download | linux-4961a5323f5d873e2170c5ef4f48538930e6df3e.tar.xz linux-4961a5323f5d873e2170c5ef4f48538930e6df3e.zip | |
[media] xc5000: use after free in release()
I moved the call to hybrid_tuner_release_state(priv) after
"priv->firmware" dereference.
Fixes: 5264a522a597 ('[media] media: tuner xc5000 - release firmwware from xc5000_release()')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Shuah Khan <shuahkh@osg.samsung.com>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Diffstat (limited to 'drivers/media')
| -rw-r--r-- | drivers/media/tuners/xc5000.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/media/tuners/xc5000.c b/drivers/media/tuners/xc5000.c index e44c8aba6074..803a0e63d47e 100644 --- a/drivers/media/tuners/xc5000.c +++ b/drivers/media/tuners/xc5000.c @@ -1333,9 +1333,9 @@ static int xc5000_release(struct dvb_frontend *fe) if (priv) { cancel_delayed_work(&priv->timer_sleep); - hybrid_tuner_release_state(priv); if (priv->firmware) release_firmware(priv->firmware); + hybrid_tuner_release_state(priv); } mutex_unlock(&xc5000_list_mutex); |