summaryrefslogtreecommitdiff
path: root/drivers/media/dvb-frontends/lgdt3306a.c
diff options
context:
space:
mode:
authorBrad Love <brad@nextdimension.cc>2018-01-05 09:57:13 -0500
committerMauro Carvalho Chehab <mchehab@s-opensource.com>2018-03-06 04:40:02 -0500
commit94448e21cf08b10f7dc7acdaca387594370396b0 (patch)
tree5d7f00c5646aa7e7429513d6c34a34e17875d1b1 /drivers/media/dvb-frontends/lgdt3306a.c
parent835d66173a38538c072a7c393d02360dcfac8582 (diff)
media: lgdt3306a: Fix a double kfree on i2c device remove
Both lgdt33606a_release and lgdt3306a_remove kfree state, but _release is called first, then _remove operates on states members before kfree'ing it. This can lead to random oops/GPF/etc on USB disconnect. Signed-off-by: Brad Love <brad@nextdimension.cc> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Diffstat (limited to 'drivers/media/dvb-frontends/lgdt3306a.c')
-rw-r--r--drivers/media/dvb-frontends/lgdt3306a.c8
1 files changed, 7 insertions, 1 deletions
diff --git a/drivers/media/dvb-frontends/lgdt3306a.c b/drivers/media/dvb-frontends/lgdt3306a.c
index adcaf9b20ce3..0ed64604d7af 100644
--- a/drivers/media/dvb-frontends/lgdt3306a.c
+++ b/drivers/media/dvb-frontends/lgdt3306a.c
@@ -1814,7 +1814,13 @@ static void lgdt3306a_release(struct dvb_frontend *fe)
struct lgdt3306a_state *state = fe->demodulator_priv;
dbg_info("\n");
- kfree(state);
+
+ /*
+ * If state->muxc is not NULL, then we are an i2c device
+ * and lgdt3306a_remove will clean up state
+ */
+ if (!state->muxc)
+ kfree(state);
}
static const struct dvb_frontend_ops lgdt3306a_ops;