[media] cx231xx: use after free on error path in probe
authorDan Carpenter <dan.carpenter@oracle.com>
Fri, 1 Nov 2013 10:34:40 +0000 (07:34 -0300)
committerMauro Carvalho Chehab <m.chehab@samsung.com>
Fri, 29 Nov 2013 16:20:32 +0000 (14:20 -0200)
We dereference "dev" after it has already been freed.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Cc: stable@vger.kernel.org
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
drivers/media/usb/cx231xx/cx231xx-cards.c

index e9d017bea377069da087751404e75f86b081c7cd..528cce958a82c4a67c91ea0c52841364db36f7d4 100644 (file)
@@ -1412,8 +1412,8 @@ err_v4l2:
        usb_set_intfdata(interface, NULL);
 err_if:
        usb_put_dev(udev);
-       kfree(dev);
        clear_bit(dev->devno, &cx231xx_devused);
+       kfree(dev);
        return retval;
 }