diff mbox

IR: ir-raw-event: null pointer dereference

Message ID 20100812074707.GJ645@bicker (mailing list archive)
State Superseded, archived
Headers

Commit Message

Dan Carpenter Aug. 12, 2010, 7:47 a.m. UTC 
  The original code dereferenced ir->raw after freeing it and setting it
to NULL.

Signed-off-by: Dan Carpenter <error27@gmail.com>

--
To unsubscribe from this list: send the line "unsubscribe linux-media" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Comments

Jarod Wilson Aug. 12, 2010, 7:36 p.m. UTC | #1 
----- Dan Carpenter <error27@gmail.com> wrote:
> The original code dereferenced ir->raw after freeing it and setting it
> to NULL.
> 
> Signed-off-by: Dan Carpenter <error27@gmail.com>


Acked-by: Jarod Wilson <jarod@redhat.com>
diff mbox

Patch

diff --git a/drivers/media/IR/ir-raw-event.c b/drivers/media/IR/ir-raw-event.c
index 43094e7..8e0e1b1 100644
--- a/drivers/media/IR/ir-raw-event.c
+++ b/drivers/media/IR/ir-raw-event.c
@@ -279,9 +279,11 @@  int ir_raw_event_register(struct input_dev *input_dev)
 			"rc%u",  (unsigned int)ir->devno);
 
 	if (IS_ERR(ir->raw->thread)) {
+		int ret = PTR_ERR(ir->raw->thread);
+
 		kfree(ir->raw);
 		ir->raw = NULL;
-		return PTR_ERR(ir->raw->thread);
+		return ret;
 	}
 
 	mutex_lock(&ir_raw_handler_lock);