media: igorplugusb: prevent use after free in probe error

The timer uses the URB. Free it only after the timer
has been stopped.

Signed-off-by: Oliver Neukum <oneukum@suse.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

diff --git a/drivers/media/rc/igorplugusb.c b/drivers/media/rc/igorplugusb.c
index b46362da862352ed1d308d0c73f4827f49a8b6e2..1afba95409ff11b8dd6532394f5a559afda4f8bb 100644 (file)
--- a/drivers/media/rc/igorplugusb.c
+++ b/drivers/media/rc/igorplugusb.c
@@ -223,9 +223,9 @@ static int igorplugusb_probe(struct usb_interface *intf,
 
        return 0;
 fail:
-       rc_free_device(ir->rc);
-       usb_free_urb(ir->urb);
        del_timer(&ir->timer);
+       usb_free_urb(ir->urb);
+       rc_free_device(ir->rc);
        kfree(ir->buf_in);
 
        return ret;