[media] xc5000: use after free in release()

I moved the call to hybrid_tuner_release_state(priv) after "priv->firmware" dereference. Fixes: 5264a52 ('[media] media: tuner xc5000 - release firmwware from xc5000_release()') Signed-off-by: Dan Carpenter <[email protected]> Reviewed-by: Shuah Khan <[email protected]> Signed-off-by: Hans Verkuil <[email protected]> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
josf · Oct 24, 2014 · 4961a53 · 4961a53
1 parent 34d7c24
commit 4961a53
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/drivers/media/tuners/xc5000.c b/drivers/media/tuners/xc5000.c
@@ -1333,9 +1333,9 @@ static int xc5000_release(struct dvb_frontend *fe)
 
 	if (priv) {
 		cancel_delayed_work(&priv->timer_sleep);
-		hybrid_tuner_release_state(priv);
 		if (priv->firmware)
 			release_firmware(priv->firmware);
+		hybrid_tuner_release_state(priv);
 	}
 
 	mutex_unlock(&xc5000_list_mutex);