From patchwork Tue Nov 25 14:57:30 2008 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jesper Juhl X-Patchwork-Id: 1658751 Return-Path: X-Original-To: patchwork-linux-media@patchwork.kernel.org Delivered-To: patchwork-process-083081@patchwork2.kernel.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by patchwork2.kernel.org (Postfix) with ESMTP id ABB97DFABE for ; Sun, 28 Oct 2012 19:58:01 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752891Ab2J1T5r (ORCPT ); Sun, 28 Oct 2012 15:57:47 -0400 Received: from 1010ds2-suoe.0.fullrate.dk ([90.184.90.115]:15635 "EHLO swampdragon.chaosbits.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752401Ab2J1T5q (ORCPT ); Sun, 28 Oct 2012 15:57:46 -0400 Received: by swampdragon.chaosbits.net (Postfix, from userid 1000) id 0476B9403D; Tue, 25 Nov 2008 15:57:30 +0100 (CET) Received: from localhost (localhost [127.0.0.1]) by swampdragon.chaosbits.net (Postfix) with ESMTP id F1AFB9403B; Tue, 25 Nov 2008 15:57:30 +0100 (CET) Date: Tue, 25 Nov 2008 15:57:30 +0100 (CET) From: Jesper Juhl To: Mauro Carvalho Chehab cc: =?ISO-8859-15?Q?Beno=EEt_Th=E9baudeau?= , Trilok Soni , Dan Carpenter , "Du, Changbin" , linux-media@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH 1/2] [media] rc: Fix double free in gpio_ir_recv_probe() Message-ID: User-Agent: Alpine 2.00 (LNX 1167 2008-08-23) MIME-Version: 1.0 Sender: linux-media-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org At the 'err_request_irq' label, rc_unregister_device(rcdev) frees its argument. So when we fall through to the 'err_gpio_request' label further down and call rc_free_device(rcdev) then that's a double free. Fix that by moving 'rcdev = NULL' from after the call to rc_free_device() to after rc_unregister_device(). That fixes the problem since rc_free_device() just does nothing if passed NULL and there's no further use of 'rcdev' after the call to rc_free_device() so it's not needed there. Signed-off-by: Jesper Juhl --- drivers/media/rc/gpio-ir-recv.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/drivers/media/rc/gpio-ir-recv.c b/drivers/media/rc/gpio-ir-recv.c index 04cb272..c698408 100644 --- a/drivers/media/rc/gpio-ir-recv.c +++ b/drivers/media/rc/gpio-ir-recv.c @@ -129,12 +129,12 @@ static int __devinit gpio_ir_recv_probe(struct platform_device *pdev) err_request_irq: platform_set_drvdata(pdev, NULL); rc_unregister_device(rcdev); + rcdev = NULL; err_register_rc_device: err_gpio_direction_input: gpio_free(pdata->gpio_nr); err_gpio_request: rc_free_device(rcdev); - rcdev = NULL; err_allocate_device: kfree(gpio_dev); return rc;