From 075dd9b83da5bc54b53b23f6e315c19b54f2d800 Mon Sep 17 00:00:00 2001 From: Xi Wang Date: Wed, 6 Mar 2013 16:32:25 -0500 Subject: [PATCH] Staging: bcm: avoid use-after-free in bcm_char_ioctl() Free pBulkBuffer (pvBuffer) after pBulkBuffer->Register. Signed-off-by: Xi Wang Signed-off-by: Greg Kroah-Hartman --- drivers/staging/bcm/Bcmchar.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/staging/bcm/Bcmchar.c b/drivers/staging/bcm/Bcmchar.c index 491e2bfbc464..35641e529396 100644 --- a/drivers/staging/bcm/Bcmchar.c +++ b/drivers/staging/bcm/Bcmchar.c @@ -1148,8 +1148,8 @@ cntrlEnd: if (((ULONG)pBulkBuffer->Register & 0x0F000000) != 0x0F000000 || ((ULONG)pBulkBuffer->Register & 0x3)) { - kfree(pvBuffer); BCM_DEBUG_PRINT (Adapter, DBG_TYPE_PRINTK, 0, 0, "WRM Done On invalid Address : %x Access Denied.\n", (int)pBulkBuffer->Register); + kfree(pvBuffer); Status = -EINVAL; break; }