From: Oliver Neukum <oneukum@suse.com>
Date: Thu, 12 May 2022 12:38:47 +0000 (+0100)
Subject: media: igorplugusb: prevent use after free in probe error
X-Git-Tag: v6.1-rc5~729^2~409
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=522f1d7d95fea3238c777148d95c1d793afa40c2;p=platform%2Fkernel%2Flinux-starfive.git

media: igorplugusb: prevent use after free in probe error

The timer uses the URB. Free it only after the timer
has been stopped.

Signed-off-by: Oliver Neukum <oneukum@suse.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
---

diff --git a/drivers/media/rc/igorplugusb.c b/drivers/media/rc/igorplugusb.c
index b46362d..1afba95 100644
--- a/drivers/media/rc/igorplugusb.c
+++ b/drivers/media/rc/igorplugusb.c
@@ -223,9 +223,9 @@ static int igorplugusb_probe(struct usb_interface *intf,
 
 	return 0;
 fail:
-	rc_free_device(ir->rc);
-	usb_free_urb(ir->urb);
 	del_timer(&ir->timer);
+	usb_free_urb(ir->urb);
+	rc_free_device(ir->rc);
 	kfree(ir->buf_in);
 
 	return ret;