From ec5f5bf80501abfe2da2897cfcde8452b545aacb Mon Sep 17 00:00:00 2001 From: Alan Cox Date: Wed, 22 Apr 2009 15:03:15 +0100 Subject: radio_si470x: Fix free memory corruption The release path for a disconnected device frees the object then unlocks the mutex in the freed object... Found by Dan Carpenter using Smatch Signed-off-by: Alan Cox Signed-off-by: Linus Torvalds --- drivers/media/radio/radio-si470x.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/media/radio/radio-si470x.c b/drivers/media/radio/radio-si470x.c index 92c297796a9..bd945d04dc9 100644 --- a/drivers/media/radio/radio-si470x.c +++ b/drivers/media/radio/radio-si470x.c @@ -1200,7 +1200,7 @@ static int si470x_fops_release(struct file *file) video_unregister_device(radio->videodev); kfree(radio->buffer); kfree(radio); - goto unlock; + goto done; } /* stop rds reception */ -- cgit v1.2.3