radio-si470x: fix possible bug with freeing memory order

Hi,

hey thanks. I appreciate and approve the patch.

Do I have to upload the patch and send Mauro a pull request or is this already done?

Bye,

Toby

Quoted 118 lines

Hello, all

There is probably bug when cleanup occurs in si470x_usb_driver_probe.

We do kmalloc for radio->buffer and when it's fail we

kfree(radio->buffer). The same with si470x_get_all_registers() and

si470x_get_scratch_page_versions(). When this functions failed we go to

err_all and try to free radio->buffer before allocation memory for this.

--

Patch fixes cleanup procedure in si470x_usb_driver_probe. Add new label

err_video and change order of freeing memory.

Signed-off-by Alexey Klimov <[email protected]>

--

diff -r 5567e82c34a0 linux/drivers/media/radio/radio-si470x.c

--- a/linux/drivers/media/radio/radio-si470x.c Tue Mar 31 07:24:14 2009 -0300

+++ b/linux/drivers/media/radio/radio-si470x.c Wed Apr 01 03:48:31 2009 +0400

linux/drivers/media/radio/radio-si470x.c +1 -1

@@ -1687,7 +1687,7 @@
 
 /* show some infos about the specific si470x device */
 
 if (si470x_get_all_registers(radio) < 0) {
 
 retval = -EIO;
 
- goto err_all;
 
+ goto err_video;

}

printk(KERN_INFO DRIVER_NAME ": DeviceID=0x%4.4hx ChipID=0x%4.4hx\n",

radio->registers[DEVICEID], radio->registers[CHIPID]);

linux/drivers/media/radio/radio-si470x.c +1 -1

@@ -1695,7 +1695,7 @@
 
 /* get software and hardware versions */
 
 if (si470x_get_scratch_page_versions(radio) < 0) {
 
 retval = -EIO;
 
- goto err_all;
 
+ goto err_video;

}

printk(KERN_INFO DRIVER_NAME

": software version %d, hardware version %d\n",

linux/drivers/media/radio/radio-si470x.c +1 -1

@@ -1728,7 +1728,7 @@
 
 radio->buffer = kmalloc(radio->buf_size, GFP_KERNEL);
 
 if (!radio->buffer) {
 
 retval = -EIO;
 
- goto err_all;
 
+ goto err_video;

}

/* rds buffer configuration */

(quoted diff) +0 -0

@@ -1750,8 +1750,9 @@
 
 
 
 return 0;
 

err_all:

+ kfree(radio->buffer);

+err_video:

video_device_release(radio->videodev);

- kfree(radio->buffer);

err_radio:

kfree(radio);

err_initial: