From patchwork Fri Apr 22 22:05:07 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Alexey Khoroshilov X-Patchwork-Id: 8915801 Return-Path: X-Original-To: patchwork-linux-media@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork2.web.kernel.org (Postfix) with ESMTP id CC165BF29F for ; Fri, 22 Apr 2016 22:07:28 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 109D02021B for ; Fri, 22 Apr 2016 22:07:28 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 27D372020F for ; Fri, 22 Apr 2016 22:07:27 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752226AbcDVWHE (ORCPT ); Fri, 22 Apr 2016 18:07:04 -0400 Received: from mail.ispras.ru ([83.149.199.45]:49118 "EHLO mail.ispras.ru" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751979AbcDVWHD (ORCPT ); Fri, 22 Apr 2016 18:07:03 -0400 Received: from localhost.localdomain (ppp85-140-185-125.pppoe.mtu-net.ru [85.140.185.125]) by mail.ispras.ru (Postfix) with ESMTPSA id AAA92540071; Sat, 23 Apr 2016 01:06:58 +0300 (MSK) From: Alexey Khoroshilov To: Mauro Carvalho Chehab , Shuah Khan Cc: Alexey Khoroshilov , linux-media@vger.kernel.org, linux-kernel@vger.kernel.org, ldv-project@linuxtesting.org Subject: [PATCH] [media] au0828: fix double free in au0828_usb_probe() Date: Sat, 23 Apr 2016 01:05:07 +0300 Message-Id: <1461362707-6883-1-git-send-email-khoroshilov@ispras.ru> X-Mailer: git-send-email 1.9.1 Sender: linux-media-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org X-Spam-Status: No, score=-7.9 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP In case of failure au0828_v4l2_device_register() deallocates dev and returns error code to au0828_usb_probe(), which also calls kfree(dev) on a failure path. The patch removes duplicated code from au0828_v4l2_device_register(). Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Alexey Khoroshilov --- drivers/media/usb/au0828/au0828-video.c | 4 ---- 1 file changed, 4 deletions(-) diff --git a/drivers/media/usb/au0828/au0828-video.c b/drivers/media/usb/au0828/au0828-video.c index 32d7db96479c..7d0ec4cb248c 100644 --- a/drivers/media/usb/au0828/au0828-video.c +++ b/drivers/media/usb/au0828/au0828-video.c @@ -679,8 +679,6 @@ int au0828_v4l2_device_register(struct usb_interface *interface, if (retval) { pr_err("%s() v4l2_device_register failed\n", __func__); - mutex_unlock(&dev->lock); - kfree(dev); return retval; } @@ -691,8 +689,6 @@ int au0828_v4l2_device_register(struct usb_interface *interface, if (retval) { pr_err("%s() v4l2_ctrl_handler_init failed\n", __func__); - mutex_unlock(&dev->lock); - kfree(dev); return retval; } dev->v4l2_dev.ctrl_handler = &dev->v4l2_ctrl_hdl;