From: Jesper Juhl <jj@chaosbits.net>
Date: Tue, 25 Nov 2008 13:57:54 +0000 (-0300)
Subject: [media] rc: Fix double free in gpio_ir_recv_remove()
X-Git-Tag: firefly_0821_release~3680^2~275^2~545
X-Git-Url: http://demsky.eecs.uci.edu/git/?a=commitdiff_plain;h=bbe2a1d32f40c01ca1a7e7795e20ca06f87ffc9b;p=firefly-linux-kernel-4.4.55.git

[media] rc: Fix double free in gpio_ir_recv_remove()

Since rc_unregister_device() frees its argument there's no need to
subsequently call rc_free_device() on the same variable - in fact it's
a double free bug.
Easily fixed by just removing the rc_free_device() call.

Signed-off-by: Jesper Juhl <jj@chaosbits.net>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
---

diff --git a/drivers/media/rc/gpio-ir-recv.c b/drivers/media/rc/gpio-ir-recv.c
index 32db5f59fbc3..03e3cf6eb68f 100644
--- a/drivers/media/rc/gpio-ir-recv.c
+++ b/drivers/media/rc/gpio-ir-recv.c
@@ -148,7 +148,6 @@ static int __devexit gpio_ir_recv_remove(struct platform_device *pdev)
 	platform_set_drvdata(pdev, NULL);
 	rc_unregister_device(gpio_dev->rcdev);
 	gpio_free(gpio_dev->gpio_nr);
-	rc_free_device(gpio_dev->rcdev);
 	kfree(gpio_dev);
 	return 0;
 }