Commit 4961a532 authored Sep 25, 2014 by Dan Carpenter Committed by Mauro Carvalho Chehab Oct 24, 2014

[media] xc5000: use after free in release()



I moved the call to hybrid_tuner_release_state(priv) after
"priv->firmware" dereference.

Fixes: 5264a522 ('[media] media: tuner xc5000 - release firmwware from xc5000_release()')

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Shuah Khan <shuahkh@osg.samsung.com>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

parent 34d7c248

drivers/media/tuners/xc5000.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -1333,9 +1333,9 @@ static int xc5000_release(struct dvb_frontend *fe)

		if (priv) {
		cancel_delayed_work(&priv->timer_sleep);
		hybrid_tuner_release_state(priv);
		if (priv->firmware)
		release_firmware(priv->firmware);
		hybrid_tuner_release_state(priv);
		}

		mutex_unlock(&xc5000_list_mutex);