V4L/DVB (6325): Double-free in cx23885_initdev
authorFlorin Malita <fmalita@gmail.com>
Sat, 13 Oct 2007 14:49:52 +0000 (11:49 -0300)
committerMauro Carvalho Chehab <mchehab@infradead.org>
Mon, 22 Oct 2007 14:01:36 +0000 (12:01 -0200)
Both cx23885_initdev and cx23885_dev_setup free the device in their
error path so a failure in the latter causes a double-free. Since
cx23885_dev_setup is only called from cx23885_initdev, it should be safe
to remove its deallocation and leave the cleanup up to the allocating
function.

Coverity CID 1922.

Signed-off-by: Florin Malita <fmalita@gmail.com>
CC: Steven Toth <stoth@hauppauge.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
drivers/media/video/cx23885/cx23885-core.c

index af16505bd2e0516a743d213c6924f57d5a3390f0..3cdd136477e58224dcca0ae81b4a5ad5ba260c45 100644 (file)
@@ -793,7 +793,7 @@ static int cx23885_dev_setup(struct cx23885_dev *dev)
                       dev->pci->subsystem_device);
 
                cx23885_devcount--;
-               goto fail_free;
+               return -ENODEV;
        }
 
        /* PCIe stuff */
@@ -835,10 +835,6 @@ static int cx23885_dev_setup(struct cx23885_dev *dev)
        }
 
        return 0;
-
-fail_free:
-       kfree(dev);
-       return -ENODEV;
 }
 
 void cx23885_dev_unregister(struct cx23885_dev *dev)