diff options
| author | Dan Carpenter | 2013-11-01 07:34:40 -0300 |
|---|---|---|
| committer | Mauro Carvalho Chehab | 2013-11-29 14:20:32 -0200 |
| commit | 7e4b918750b494b68e24222dea5f7d85e90db022 (patch) | |
| tree | 448e76b8abf095f948940715aea42588ce8c942f /drivers | |
| parent | 89f4d45b2752df5d222b5f63919ce59e2d8afaf4 (diff) | |
[media] cx231xx: use after free on error path in probe
We dereference "dev" after it has already been freed.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Cc: stable@vger.kernel.org
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/media/usb/cx231xx/cx231xx-cards.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/media/usb/cx231xx/cx231xx-cards.c b/drivers/media/usb/cx231xx/cx231xx-cards.c index e9d017bea377..528cce958a82 100644 --- a/drivers/media/usb/cx231xx/cx231xx-cards.c +++ b/drivers/media/usb/cx231xx/cx231xx-cards.c @@ -1412,8 +1412,8 @@ err_v4l2: usb_set_intfdata(interface, NULL); err_if: usb_put_dev(udev); - kfree(dev); clear_bit(dev->devno, &cx231xx_devused); + kfree(dev); return retval; } |