V4L/DVB (13948): radio: Correct use after free
authorJulia Lawall <julia@diku.dk>
Tue, 22 Dec 2009 20:31:23 +0000 (17:31 -0300)
committerMauro Carvalho Chehab <mchehab@redhat.com>
Fri, 26 Feb 2010 18:10:33 +0000 (15:10 -0300)
commited0ee8e1fbab49b494ef2994be92e7832dd6673c
treec162c47226806b6dc5ca25821ce58b9856764dfc
parente0572325d23b8c89930a08e0b8b3850a6fe75d7d
V4L/DVB (13948): radio: Correct use after free

It is not clear how to share the unlock in the case where the structure
containing the lock has to be freed.  So the unlock is now duplicated, with
one copy moved before the free.  The unlock label furthermore is no longer
useful and is thus deleted.

A simplified version of the semantic match that finds this problem is as
follows: (http://coccinelle.lip6.fr/)

// <smpl>
@@
expression x,e;
identifier f;
iterator I;
statement S;
@@

*kfree(x);
... when != &x
    when != x = e
    when != I(x,...) S
*x->f
// </smpl>

Signed-off-by: Julia Lawall <julia@diku.dk>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
drivers/media/radio/si470x/radio-si470x-usb.c