From: Alan Cox <alan@lxorguk.ukuu.org.uk>
Date: Wed, 22 Apr 2009 14:03:15 +0000 (+0100)
Subject: radio_si470x: Fix free memory corruption
X-Git-Tag: v3.0~9404
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=ec5f5bf80501abfe2da2897cfcde8452b545aacb;p=platform%2Fkernel%2Flinux-amlogic.git

radio_si470x: Fix free memory corruption

The release path for a disconnected device frees the object then unlocks
the mutex in the freed object...

Found by Dan Carpenter using Smatch

Signed-off-by: Alan Cox <alan@lxorguk.ukuu.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
---

diff --git a/drivers/media/radio/radio-si470x.c b/drivers/media/radio/radio-si470x.c
index 92c2977..bd945d0 100644
--- a/drivers/media/radio/radio-si470x.c
+++ b/drivers/media/radio/radio-si470x.c
@@ -1200,7 +1200,7 @@ static int si470x_fops_release(struct file *file)
 			video_unregister_device(radio->videodev);
 			kfree(radio->buffer);
 			kfree(radio);
-			goto unlock;
+			goto done;
 		}
 
 		/* stop rds reception */