Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 08da558a authored by Dan Carpenter's avatar Dan Carpenter Committed by Mauro Carvalho Chehab
Browse files

[media] V4L: mt9t112: use after free in mt9t112_probe() 



priv gets dereferenced in mt9t112_set_params() so we should return
before calling that.

Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarGuennadi Liakhovetski <g.liakhovetski@gmx.de>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@redhat.com>
parent 4c0b036d

drivers/media/video/mt9t112.c

+3 −1
Original line number Diff line number Diff line
@@ -1083,8 +1083,10 @@ static int mt9t112_probe(struct i2c_client *client, 
	v4l2_i2c_subdev_init(&priv->subdev, client, &mt9t112_subdev_ops);



	ret = mt9t112_camera_probe(client);

	if (ret)

	if (ret) {

		kfree(priv);

		return ret;

	}



	/* Cannot fail: using the default supported pixel code */

	mt9t112_set_params(priv, &rect, V4L2_MBUS_FMT_UYVY8_2X8);