* [patch -next] [media] cx231xx: use after free on error path in probe
@ 2013-11-01 10:34 Dan Carpenter
0 siblings, 0 replies; only message in thread
From: Dan Carpenter @ 2013-11-01 10:34 UTC (permalink / raw)
To: Mauro Carvalho Chehab
Cc: Hans Verkuil, Alexey Khoroshilov, Alf Høgemark,
Peter Senna Tschudin, Johannes Erdfelt, Ezequiel Garcia,
Matt Gomboc, linux-media, kernel-janitors
We dereference "dev" after it has already been freed.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/drivers/media/usb/cx231xx/cx231xx-cards.c b/drivers/media/usb/cx231xx/cx231xx-cards.c
index e9d017b..528cce9 100644
--- a/drivers/media/usb/cx231xx/cx231xx-cards.c
+++ b/drivers/media/usb/cx231xx/cx231xx-cards.c
@@ -1412,8 +1412,8 @@ err_v4l2:
usb_set_intfdata(interface, NULL);
err_if:
usb_put_dev(udev);
- kfree(dev);
clear_bit(dev->devno, &cx231xx_devused);
+ kfree(dev);
return retval;
}
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2013-11-01 10:42 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-11-01 10:34 [patch -next] [media] cx231xx: use after free on error path in probe Dan Carpenter
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox