Commit 522f1d7d authored by Oliver Neukum's avatar Oliver Neukum Committed by Mauro Carvalho Chehab
Browse files

media: igorplugusb: prevent use after free in probe error 



The timer uses the URB. Free it only after the timer
has been stopped.

Signed-off-by: default avatarOliver Neukum <oneukum@suse.com>
Signed-off-by: default avatarSean Young <sean@mess.org>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@kernel.org>
parent b3f820b9

drivers/media/rc/igorplugusb.c

+2 −2
Original line number Diff line number Diff line
@@ -223,9 +223,9 @@ static int igorplugusb_probe(struct usb_interface *intf, 


	return 0;

fail:

	rc_free_device(ir->rc);

	usb_free_urb(ir->urb);

	del_timer(&ir->timer);

	usb_free_urb(ir->urb);

	rc_free_device(ir->rc);

	kfree(ir->buf_in);



	return ret;