Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ec5f5bf8 authored by Alan Cox's avatar Alan Cox Committed by Linus Torvalds
Browse files

radio_si470x: Fix free memory corruption 



The release path for a disconnected device frees the object then unlocks
the mutex in the freed object...

Found by Dan Carpenter using Smatch

Signed-off-by: default avatarAlan Cox <alan@lxorguk.ukuu.org.uk>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 79e95eba

drivers/media/radio/radio-si470x.c

+1 −1
Original line number Diff line number Diff line
@@ -1200,7 +1200,7 @@ static int si470x_fops_release(struct file *file) 
			video_unregister_device(radio->videodev);

			kfree(radio->buffer);

			kfree(radio);

			goto unlock;

			goto done;

		}



		/* stop rds reception */