diff options
| author | Xi Wang | 2013-03-06 22:32:25 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman | 2013-03-11 17:15:32 +0100 |
| commit | 075dd9b83da5bc54b53b23f6e315c19b54f2d800 (patch) | |
| tree | f5a30f0263a9c7c20974344419828093eebb1b0f /drivers/staging | |
| parent | staging/sep: Check pointers before dereferencing (fix smatch warning) (diff) | |
| download | kernel-qcow2-linux-075dd9b83da5bc54b53b23f6e315c19b54f2d800.tar.gz kernel-qcow2-linux-075dd9b83da5bc54b53b23f6e315c19b54f2d800.tar.xz kernel-qcow2-linux-075dd9b83da5bc54b53b23f6e315c19b54f2d800.zip | |
Staging: bcm: avoid use-after-free in bcm_char_ioctl()
Free pBulkBuffer (pvBuffer) after pBulkBuffer->Register.
Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/staging')
| -rw-r--r-- | drivers/staging/bcm/Bcmchar.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/staging/bcm/Bcmchar.c b/drivers/staging/bcm/Bcmchar.c index 491e2bfbc464..35641e529396 100644 --- a/drivers/staging/bcm/Bcmchar.c +++ b/drivers/staging/bcm/Bcmchar.c @@ -1148,8 +1148,8 @@ cntrlEnd: if (((ULONG)pBulkBuffer->Register & 0x0F000000) != 0x0F000000 || ((ULONG)pBulkBuffer->Register & 0x3)) { - kfree(pvBuffer); BCM_DEBUG_PRINT (Adapter, DBG_TYPE_PRINTK, 0, 0, "WRM Done On invalid Address : %x Access Denied.\n", (int)pBulkBuffer->Register); + kfree(pvBuffer); Status = -EINVAL; break; } |