[patch] [media] xc5000: use after free in release()

[Dan Carpenter]

I moved the call to hybrid_tuner_release_state(priv) after
"priv->firmware" dereference.

Fixes: 5264a522a597 ('[media] media: tuner xc5000 - release firmwware from 
xc5000_release()')
Signed-off-by: Dan Carpenter <dan.carpen...@oracle.com>

diff --git a/drivers/media/tuners/xc5000.c b/drivers/media/tuners/xc5000.c
index e44c8ab..803a0e6 100644
--- a/drivers/media/tuners/xc5000.c
+++ b/drivers/media/tuners/xc5000.c
@@ -1333,9 +1333,9 @@ static int xc5000_release(struct dvb_frontend *fe)
 
        if (priv) {
                cancel_delayed_work(&priv->timer_sleep);
-               hybrid_tuner_release_state(priv);
                if (priv->firmware)
                        release_firmware(priv->firmware);
+               hybrid_tuner_release_state(priv);
        }
 
        mutex_unlock(&xc5000_list_mutex);
--
To unsubscribe from this list: send the line "unsubscribe linux-media" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html