Commit 4961a532 authored by Dan Carpenter's avatar Dan Carpenter Committed by Mauro Carvalho Chehab

[media] xc5000: use after free in release()

I moved the call to hybrid_tuner_release_state(priv) after
"priv->firmware" dereference.

Fixes: 5264a522 ('[media] media: tuner xc5000 - release firmwware from xc5000_release()')
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: default avatarShuah Khan <shuahkh@osg.samsung.com>
Signed-off-by: default avatarHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@osg.samsung.com>
parent 34d7c248
...@@ -1333,9 +1333,9 @@ static int xc5000_release(struct dvb_frontend *fe) ...@@ -1333,9 +1333,9 @@ static int xc5000_release(struct dvb_frontend *fe)
if (priv) { if (priv) {
cancel_delayed_work(&priv->timer_sleep); cancel_delayed_work(&priv->timer_sleep);
hybrid_tuner_release_state(priv);
if (priv->firmware) if (priv->firmware)
release_firmware(priv->firmware); release_firmware(priv->firmware);
hybrid_tuner_release_state(priv);
} }
mutex_unlock(&xc5000_list_mutex); mutex_unlock(&xc5000_list_mutex);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment