aboutsummaryrefslogtreecommitdiff
path: root/drivers
diff options
context:
space:
mode:
authorDan Carpenter <error27@gmail.com>2010-08-12 04:47:07 -0300
committerMauro Carvalho Chehab <mchehab@redhat.com>2010-09-27 22:21:46 -0300
commit028816bc85db5ac6a562c2aff2113c7480d67919 (patch)
treeb3c2bde2704014eb2bb5c13ceb6aaa70dca21d0b /drivers
parent590a58d18027b18db78f538aca592c2cdb249079 (diff)
downloadlinux-2.6.38-lt-ux500-028816bc85db5ac6a562c2aff2113c7480d67919.tar.gz
V4L/DVB: IR: ir-raw-event: null pointer dereference
The original code dereferenced ir->raw after freeing it and setting it to NULL. Signed-off-by: Dan Carpenter <error27@gmail.com> Acked-by: Jarod Wilson <jarod@redhat.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Diffstat (limited to 'drivers')
-rw-r--r--drivers/media/IR/ir-raw-event.c4
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/media/IR/ir-raw-event.c b/drivers/media/IR/ir-raw-event.c
index 43094e7eccf..8e0e1b1f8c8 100644
--- a/drivers/media/IR/ir-raw-event.c
+++ b/drivers/media/IR/ir-raw-event.c
@@ -279,9 +279,11 @@ int ir_raw_event_register(struct input_dev *input_dev)
"rc%u", (unsigned int)ir->devno);
if (IS_ERR(ir->raw->thread)) {
+ int ret = PTR_ERR(ir->raw->thread);
+
kfree(ir->raw);
ir->raw = NULL;
- return PTR_ERR(ir->raw->thread);
+ return ret;
}
mutex_lock(&ir_raw_handler_lock);