diff mbox

rtc: use after free in pcf50633_rtc_probe()

Message ID alpine.DEB.2.00.0907171624420.12306@bicker
State Superseded, archived
Headers show

Commit Message

Dan Carpenter July 19, 2009, 11:56 a.m. UTC
"rtc" is freed and then dereferenced on the 
next line.  This patch fixes that.

Found by smatch (http://repo.or.cz/w/smatch.git).

regards,
dan carpenter

Signed-off-by: Dan Carpenter <error27@gmail.com>


--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to "rtc-linux".
Membership options at http://groups.google.com/group/rtc-linux .
Please read http://groups.google.com/group/rtc-linux/web/checklist
before submitting a driver.
-~----------~----~----~----~------~----~------~--~---
diff mbox

Patch

--- orig/drivers/rtc/rtc-pcf50633.c	2009-07-17 16:21:52.000000000 +0300
+++ new/drivers/rtc/rtc-pcf50633.c	2009-07-17 16:22:56.000000000 +0300
@@ -291,8 +291,9 @@ 
 				&pcf50633_rtc_ops, THIS_MODULE);
 
 	if (IS_ERR(rtc->rtc_dev)) {
+		int ret =  PTR_ERR(rtc->rtc_dev);
 		kfree(rtc);
-		return PTR_ERR(rtc->rtc_dev);
+		return ret;
 	}
 
 	pcf50633_register_irq(rtc->pcf, PCF50633_IRQ_ALARM,