If the memory allocation to 'state' succeeds but we jump to the 'error' label before 'state' is assigned to fe->tuner_priv, then the call to 'zl10036_release(fe)' at the 'error:' label will not free 'state', but only what was previously assigned to 'tuner_priv', thus leaking the memory allocated to 'state'. There are may ways to fix this, including assigning the allocated memory directly to 'fe->tuner_priv', but I did not go for that since the additional pointer derefs are more expensive than the local variable, so I just added a 'kfree(state)' call. I guess the call to 'zl10036_release' might not even be needed in this case, but I wasn't sure, so I left it in. Signed-off-by: Jesper Juhl <jj@xxxxxxxxxxxxx> --- zl10036.c | 1 + 1 file changed, 1 insertion(+) compile tested only. diff --git a/drivers/media/dvb/frontends/zl10036.c b/drivers/media/dvb/frontends/zl10036.c index 4627f49..b4fb8e8 100644 --- a/drivers/media/dvb/frontends/zl10036.c +++ b/drivers/media/dvb/frontends/zl10036.c @@ -508,6 +508,7 @@ struct dvb_frontend *zl10036_attach(struct dvb_frontend *fe, error: zl10036_release(fe); + kfree(state); return NULL; } EXPORT_SYMBOL(zl10036_attach); -- Jesper Juhl <jj@xxxxxxxxxxxxx> http://www.chaosbits.net/ Plain text mails only, please. Don't top-post http://www.catb.org/~esr/jargon/html/T/top-post.html -- To unsubscribe from this list: send the line "unsubscribe linux-media" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
