The patch titled drivers/media/video/saa5249.c: fix use-after-free and leak has been removed from the -mm tree. Its filename was drivers-media-video-saa5249c-fix-use-after-free-and-leak.patch This patch was dropped because it was merged into mainline or a subsystem tree The current -mm tree may be found at http://userweb.kernel.org/~akpm/mmotm/ ------------------------------------------------------ Subject: drivers/media/video/saa5249.c: fix use-after-free and leak From: Dan Carpenter <error27@xxxxxxxxx> I moved the kfree() down a couple lines. t->vdev is going to be in freed memory so there is no point setting it to NULL. I added a kfree(t) on a different error path. Signed-off-by: Dan Carpenter <error27@xxxxxxxxx> Cc: Mauro Carvalho Chehab <mchehab@xxxxxxxxxxxxx> Cc: Hans Verkuil <hverkuil@xxxxxxxxx> Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> --- drivers/media/video/saa5249.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff -puN drivers/media/video/saa5249.c~drivers-media-video-saa5249c-fix-use-after-free-and-leak drivers/media/video/saa5249.c --- a/drivers/media/video/saa5249.c~drivers-media-video-saa5249c-fix-use-after-free-and-leak +++ a/drivers/media/video/saa5249.c @@ -598,6 +598,7 @@ static int saa5249_probe(struct i2c_clie /* Now create a video4linux device */ t->vdev = video_device_alloc(); if (t->vdev == NULL) { + kfree(t); kfree(client); return -ENOMEM; } @@ -617,9 +618,8 @@ static int saa5249_probe(struct i2c_clie /* Register it */ err = video_register_device(t->vdev, VFL_TYPE_VTX, -1); if (err < 0) { - kfree(t); video_device_release(t->vdev); - t->vdev = NULL; + kfree(t); return err; } return 0; _ Patches currently in -mm which might be from error27@xxxxxxxxx are linux-next.patch rxrpc-fix-error-handling-for-rxrpc_alloc_connection.patch -- To unsubscribe from this list: send the line "unsubscribe mm-commits" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html