[patch review] radio-si470x: fix possible bug with freeing memory order

[Alexey Klimov <klimov.linux@gmail.com>]

Hello, all

There is probably bug when cleanup occurs in si470x_usb_driver_probe.
We do kmalloc for radio->buffer and when it's fail we
kfree(radio->buffer). The same with si470x_get_all_registers() and 
si470x_get_scratch_page_versions(). When this functions failed we go to
err_all and try to free radio->buffer before allocation memory for this.

--
Patch fixes cleanup procedure in si470x_usb_driver_probe. Add new label
err_video and change order of freeing memory.

Signed-off-by: Alexey Klimov <klimov.linux@gmail.com>
--
diff -r 5567e82c34a0 linux/drivers/media/radio/radio-si470x.c
--- a/linux/drivers/media/radio/radio-si470x.c	Tue Mar 31 07:24:14 2009 -0300
+++ b/linux/drivers/media/radio/radio-si470x.c	Wed Apr 01 03:48:31 2009 +0400
@@ -1687,7 +1687,7 @@
 	/* show some infos about the specific si470x device */
 	if (si470x_get_all_registers(radio) < 0) {
 		retval = -EIO;
-		goto err_all;
+		goto err_video;
 	}
 	printk(KERN_INFO DRIVER_NAME ": DeviceID=0x%4.4hx ChipID=0x%4.4hx\n",
 			radio->registers[DEVICEID], radio->registers[CHIPID]);
@@ -1695,7 +1695,7 @@
 	/* get software and hardware versions */
 	if (si470x_get_scratch_page_versions(radio) < 0) {
 		retval = -EIO;
-		goto err_all;
+		goto err_video;
 	}
 	printk(KERN_INFO DRIVER_NAME
 			": software version %d, hardware version %d\n",
@@ -1728,7 +1728,7 @@
 	radio->buffer = kmalloc(radio->buf_size, GFP_KERNEL);
 	if (!radio->buffer) {
 		retval = -EIO;
-		goto err_all;
+		goto err_video;
 	}
 
 	/* rds buffer configuration */
@@ -1750,8 +1750,9 @@
 
 	return 0;
 err_all:
+	kfree(radio->buffer);
+err_video:
 	video_device_release(radio->videodev);
-	kfree(radio->buffer);
 err_radio:
 	kfree(radio);
 err_initial:



-- 
Best regards, Klimov Alexey