Commit 7e4b9187 authored by Dan Carpenter's avatar Dan Carpenter Committed by Mauro Carvalho Chehab

[media] cx231xx: use after free on error path in probe

We dereference "dev" after it has already been freed.
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarHans Verkuil <hans.verkuil@cisco.com>
Cc: stable@vger.kernel.org
Signed-off-by: default avatarMauro Carvalho Chehab <m.chehab@samsung.com>
parent 89f4d45b
...@@ -1412,8 +1412,8 @@ static int cx231xx_usb_probe(struct usb_interface *interface, ...@@ -1412,8 +1412,8 @@ static int cx231xx_usb_probe(struct usb_interface *interface,
usb_set_intfdata(interface, NULL); usb_set_intfdata(interface, NULL);
err_if: err_if:
usb_put_dev(udev); usb_put_dev(udev);
kfree(dev);
clear_bit(dev->devno, &cx231xx_devused); clear_bit(dev->devno, &cx231xx_devused);
kfree(dev);
return retval; return retval;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment