diff options
| author | Colin Ian King <colin.king@canonical.com> | 2017-02-17 14:17:30 -0200 |
|---|---|---|
| committer | Mauro Carvalho Chehab <mchehab@s-opensource.com> | 2017-04-17 12:09:52 -0300 |
| commit | 21f9f2ef7c12dcefbdadaf96382bf547f84f23b3 (patch) | |
| tree | 253fce12816b835ee4c03256158623dcd2956e1f /drivers/staging/media | |
| parent | 56b27d4dd3eccff618be2f8417aef86f59a2c0d4 (diff) | |
[media] Staging: media/lirc: don't call put_ir_rx on rx twice
There is an exit path where rx is kfree'd on put_ir_rx and then
a jump to label out_put_xx will again kfree it with another
call to put_ir_rx. Fix this by adding a new label that avoids
this 2nd call to put_ir_rx for this specific case.
Detected with CoverityScan, CID#145119 ("Use after free")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Diffstat (limited to 'drivers/staging/media')
| -rw-r--r-- | drivers/staging/media/lirc/lirc_zilog.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/staging/media/lirc/lirc_zilog.c b/drivers/staging/media/lirc/lirc_zilog.c index e4a533b6beb3..24735521edae 100644 --- a/drivers/staging/media/lirc/lirc_zilog.c +++ b/drivers/staging/media/lirc/lirc_zilog.c @@ -1597,7 +1597,7 @@ static int ir_probe(struct i2c_client *client, const struct i2c_device_id *id) i2c_set_clientdata(client, NULL); put_ir_rx(rx, true); ir->l.features &= ~LIRC_CAN_REC_LIRCCODE; - goto out_put_xx; + goto out_put_tx; } /* Proceed only if the Tx client is also ready */ @@ -1637,6 +1637,7 @@ out_ok: out_put_xx: if (rx != NULL) put_ir_rx(rx, true); +out_put_tx: if (tx != NULL) put_ir_tx(tx, true); out_put_ir: |