radio_si470x: Fix free memory corruption

The release path for a disconnected device frees the object then unlocks the mutex in the freed object... Found by Dan Carpenter using Smatch Signed-off-by: Alan Cox <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
mrcheets · Apr 24, 2009 · ec5f5bf · ec5f5bf
1 parent 79e95eb
commit ec5f5bf
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/drivers/media/radio/radio-si470x.c b/drivers/media/radio/radio-si470x.c
@@ -1200,7 +1200,7 @@ static int si470x_fops_release(struct file *file)
 			video_unregister_device(radio->videodev);
 			kfree(radio->buffer);
 			kfree(radio);
-			goto unlock;
+			goto done;
 		}
 
 		/* stop rds reception */