* [patch] [media] V4L: mt9t112: use after free in mt9t112_probe()
@ 2011-11-07 18:44 Dan Carpenter
0 siblings, 0 replies; only message in thread
From: Dan Carpenter @ 2011-11-07 18:44 UTC (permalink / raw)
To: Mauro Carvalho Chehab
Cc: Guennadi Liakhovetski, Paul Mundt, Hans Verkuil, linux-media,
kernel-janitors
priv gets dereferenced in mt9t112_set_params() so we should return
before calling that.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/drivers/media/video/mt9t112.c b/drivers/media/video/mt9t112.c
index 32114a3..7b34b11 100644
--- a/drivers/media/video/mt9t112.c
+++ b/drivers/media/video/mt9t112.c
@@ -1083,8 +1083,10 @@ static int mt9t112_probe(struct i2c_client *client,
v4l2_i2c_subdev_init(&priv->subdev, client, &mt9t112_subdev_ops);
ret = mt9t112_camera_probe(client);
- if (ret)
+ if (ret) {
kfree(priv);
+ return ret;
+ }
/* Cannot fail: using the default supported pixel code */
mt9t112_set_params(priv, &rect, V4L2_MBUS_FMT_UYVY8_2X8);
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2011-11-07 18:44 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2011-11-07 18:44 [patch] [media] V4L: mt9t112: use after free in mt9t112_probe() Dan Carpenter
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox