From patchwork Thu Feb 11 11:07:53 2010
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
X-Patchwork-Submitter: Darren Jenkins <darrenrjenkins@gmail.com>
X-Patchwork-Id: 78687
Received: from vger.kernel.org (vger.kernel.org [209.132.180.67])
	by demeter.kernel.org (8.14.3/8.14.3) with ESMTP id o1BB8Sda011858
	for <patchwork-media@patchwork.kernel.org>;
	Thu, 11 Feb 2010 11:08:28 GMT
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
	id S1753421Ab0BKLIE (ORCPT
	<rfc822;patchwork-media@patchwork.kernel.org>);
	Thu, 11 Feb 2010 06:08:04 -0500
Received: from mail-gx0-f224.google.com ([209.85.217.224]:60174 "EHLO
	mail-gx0-f224.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
	with ESMTP id S1753300Ab0BKLIA (ORCPT
	<rfc822;linux-media@vger.kernel.org>);
	Thu, 11 Feb 2010 06:08:00 -0500
Received: by gxk24 with SMTP id 24so978238gxk.1
	for <multiple recipients>; Thu, 11 Feb 2010 03:07:59 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma;
	h=domainkey-signature:received:received:subject:from:to:cc
	:content-type:date:message-id:mime-version:x-mailer
	:content-transfer-encoding;
	bh=yQ9+MkP16St97ZEsNf8dIzuYspGq9Eepg/9We2PsevY=;
	b=cQtMbpv8EHE0Vcvra94Zd39Z4rAVCDe7MK2yhQajKjF2YgK2UXs95oFScy+rlIDfEd
	maIvptKyfmhr9UMFijnryMerP7/nzm6fEUOb/3ZIHq88qNUIuDohvP9hnxKfxj1Avicq
	FkrhVNJPSdsAwceU8+hagH97z0U0XTZGYyYUo=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma;
	h=subject:from:to:cc:content-type:date:message-id:mime-version
	:x-mailer:content-transfer-encoding;
	b=CHVP2nLPyr6Eyo4Fj/vIMsBu0hjOJ+/uVtJeviGp4WbLKcLzBdShKhYgLlYdr7ccoK
	dglQ6Pm23jCDJW2dZsip1W1pZUzYMfLJ9aZuBLUoBmGc5Fl9yZSkmYbq0caXW3wmZOd1
	vFoR3G6OEB1frL1umbho9qF24l8KSv8sI6kiU=
Received: by 10.150.241.25 with SMTP id o25mr1214338ybh.54.1265886479614;
	Thu, 11 Feb 2010 03:07:59 -0800 (PST)
Received: from ?192.168.2.3? (C-59-101-225-152.bur.connect.net.au
	[59.101.225.152])
	by mx.google.com with ESMTPS id 35sm844531yxh.69.2010.02.11.03.07.55
	(version=SSLv3 cipher=RC4-MD5);
	Thu, 11 Feb 2010 03:07:58 -0800 (PST)
Subject: [PATCH] drivers/media/radio/si470x/radio-si470x-usb.c fix use
	after free
From: Darren Jenkins <darrenrjenkins@gmail.com>
To: Mauro Carvalho Chehab <mchehab@infradead.org>
Cc: Tobias Lorenz <tobias.lorenz@gmx.net>,
	Tobias Lorenz <tobias.lorenz@gmx.net>,
	Douglas Schilling Landgraf <dougsland@redhat.com>,
	linux-media@vger.kernel.org,
	Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
	Kernel Janitors <kernel-janitors@vger.kernel.org>
Date: Thu, 11 Feb 2010 22:07:53 +1100
Message-ID: <1265886473.27789.6.camel@ICE-BOX>
Mime-Version: 1.0
X-Mailer: Evolution 2.28.1 
Sender: linux-media-owner@vger.kernel.org
Precedence: bulk
List-ID: <linux-media.vger.kernel.org>
X-Mailing-List: linux-media@vger.kernel.org
X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by
	milter-greylist-4.2.3 (demeter.kernel.org [140.211.167.41]);
	Thu, 11 Feb 2010 11:08:28 +0000 (UTC)


diff --git a/drivers/media/radio/si470x/radio-si470x-usb.c b/drivers/media/radio/si470x/radio-si470x-usb.c
index a96e1b9..1588a9d 100644
--- a/drivers/media/radio/si470x/radio-si470x-usb.c
+++ b/drivers/media/radio/si470x/radio-si470x-usb.c
@@ -842,9 +842,11 @@ static void si470x_usb_driver_disconnect(struct usb_interface *intf)
 		kfree(radio->int_in_buffer);
 		video_unregister_device(radio->videodev);
 		kfree(radio->buffer);
+		mutex_unlock(&radio->disconnect_lock);
 		kfree(radio);
+	} else {
+		mutex_unlock(&radio->disconnect_lock);
 	}
-	mutex_unlock(&radio->disconnect_lock);
 }