Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 085575a3 authored by Oliver Neukum's avatar Oliver Neukum Committed by Mauro Carvalho Chehab
Browse files

V4L/DVB (12369): stv680: kfree called before usb_kill_urb 



The irq handler will touch memory. Even in the error case some URBs may
complete. Thus no memory must be kfreed before all URBs are killed.

Signed-off-by: default avatarOliver Neukum <oliver@neukum.org>
Acked-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: default avatarDouglas Schilling Landgraf <dougsland@redhat.com>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@redhat.com>
parent f5d887ae

drivers/media/video/stv680.c

+5 −4
Original line number Diff line number Diff line
@@ -734,10 +734,6 @@ static int stv680_start_stream (struct usb_stv *stv680) 
	return 0;



 nomem_err:

	for (i = 0; i < STV680_NUMSCRATCH; i++) {

		kfree(stv680->scratch[i].data);

		stv680->scratch[i].data = NULL;

	}

	for (i = 0; i < STV680_NUMSBUF; i++) {

		usb_kill_urb(stv680->urb[i]);

		usb_free_urb(stv680->urb[i]);
@@ -745,6 +741,11 @@ static int stv680_start_stream (struct usb_stv *stv680) 
		kfree(stv680->sbuf[i].data);

		stv680->sbuf[i].data = NULL;

	}

	/* used in irq, free only as all URBs are dead */

	for (i = 0; i < STV680_NUMSCRATCH; i++) {

		kfree(stv680->scratch[i].data);

		stv680->scratch[i].data = NULL;

	}

	return -ENOMEM;



}