Patch "media: si470x-i2c: Move free() past last use of 'radio'" has been added to the 4.19-stable tree

From: <gregkh@linuxfoundation.org>
To: gregkh@linuxfoundation.org, julia.lawall@lip6.fr,
	lee.jones@linaro.org, linux-arm-kernel@lists.infradead.org,
	lkp@intel.com
Cc: stable-commits@vger.kernel.org
Subject: Patch "media: si470x-i2c: Move free() past last use of 'radio'" has been added to the 4.19-stable tree
Date: Mon, 03 Feb 2020 15:02:00 +0000	[thread overview]
Message-ID: <15807421201458@kroah.com> (raw)
In-Reply-To: <20200203132130.12748-1-lee.jones@linaro.org>


This is a note to let you know that I've just added the patch titled

    media: si470x-i2c: Move free() past last use of 'radio'

to the 4.19-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     media-si470x-i2c-move-free-past-last-use-of-radio.patch
and it can be found in the queue-4.19 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.


From lee.jones@linaro.org  Mon Feb  3 14:58:36 2020
From: Lee Jones <lee.jones@linaro.org>
Date: Mon,  3 Feb 2020 13:21:30 +0000
Subject: media: si470x-i2c: Move free() past last use of 'radio'
To: stable@vger.kernel.org
Cc: linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org
Message-ID: <20200203132130.12748-1-lee.jones@linaro.org>

From: Lee Jones <lee.jones@linaro.org>

A pointer to 'struct si470x_device' is currently used after free:

  drivers/media/radio/si470x/radio-si470x-i2c.c:462:25-30: ERROR: reference
    preceded by free on line 460

Shift the call to free() down past its final use.

NB: Not sending to Mainline, since the problem does not exist there, it was
caused by the backport of 2df200ab234a ("media: si470x-i2c: add missed
operations in remove") to the stable trees.

Cc: <stable@vger.kernel.org> # v3.18+
Reported-by: kbuild test robot <lkp@intel.com>
Reported-by: Julia Lawall <julia.lawall@lip6.fr>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/media/radio/si470x/radio-si470x-i2c.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/media/radio/si470x/radio-si470x-i2c.c
+++ b/drivers/media/radio/si470x/radio-si470x-i2c.c
@@ -483,10 +483,10 @@ static int si470x_i2c_remove(struct i2c_
 
 	free_irq(client->irq, radio);
 	video_unregister_device(&radio->videodev);
-	kfree(radio);
 
 	v4l2_ctrl_handler_free(&radio->hdl);
 	v4l2_device_unregister(&radio->v4l2_dev);
+	kfree(radio);
 	return 0;
 }
 


Patches currently in stable-queue which might be from lee.jones@linaro.org are

queue-4.19/media-si470x-i2c-move-free-past-last-use-of-radio.patch

_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
