From: Greg Kroah-Hartman Date: Mon, 3 Feb 2020 15:02:00 +0000 (+0000) Subject: 4.19-stable patches X-Git-Tag: v5.5.2~19 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=38e4b50f28bfa048640c89b5dc4285d164d7d878;p=thirdparty%2Fkernel%2Fstable-queue.git 4.19-stable patches added patches: media-si470x-i2c-move-free-past-last-use-of-radio.patch --- diff --git a/queue-4.19/media-si470x-i2c-move-free-past-last-use-of-radio.patch b/queue-4.19/media-si470x-i2c-move-free-past-last-use-of-radio.patch new file mode 100644 index 00000000000..0165293e1a6 --- /dev/null +++ b/queue-4.19/media-si470x-i2c-move-free-past-last-use-of-radio.patch @@ -0,0 +1,45 @@ +From lee.jones@linaro.org Mon Feb 3 14:58:36 2020 +From: Lee Jones +Date: Mon, 3 Feb 2020 13:21:30 +0000 +Subject: media: si470x-i2c: Move free() past last use of 'radio' +To: stable@vger.kernel.org +Cc: linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org +Message-ID: <20200203132130.12748-1-lee.jones@linaro.org> + +From: Lee Jones + +A pointer to 'struct si470x_device' is currently used after free: + + drivers/media/radio/si470x/radio-si470x-i2c.c:462:25-30: ERROR: reference + preceded by free on line 460 + +Shift the call to free() down past its final use. + +NB: Not sending to Mainline, since the problem does not exist there, it was +caused by the backport of 2df200ab234a ("media: si470x-i2c: add missed +operations in remove") to the stable trees. + +Cc: # v3.18+ +Reported-by: kbuild test robot +Reported-by: Julia Lawall +Signed-off-by: Lee Jones +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/radio/si470x/radio-si470x-i2c.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/media/radio/si470x/radio-si470x-i2c.c ++++ b/drivers/media/radio/si470x/radio-si470x-i2c.c +@@ -483,10 +483,10 @@ static int si470x_i2c_remove(struct i2c_ + + free_irq(client->irq, radio); + video_unregister_device(&radio->videodev); +- kfree(radio); + + v4l2_ctrl_handler_free(&radio->hdl); + v4l2_device_unregister(&radio->v4l2_dev); ++ kfree(radio); + return 0; + } + diff --git a/queue-4.19/series b/queue-4.19/series index 205555a4c78..f76750f2063 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -21,3 +21,4 @@ tomoyo-use-atomic_t-for-statistics-counter.patch ttyprintk-fix-a-potential-deadlock-in-interrupt-context-issue.patch bluetooth-fix-race-condition-in-hci_release_sock.patch cgroup-prevent-double-killing-of-css-when-enabling-threaded-cgroup.patch +media-si470x-i2c-move-free-past-last-use-of-radio.patch