* iwmc3200wifi: using freed memory in iwm_hal_send_target_cmd()
@ 2009-07-19 11:53 Dan Carpenter
2009-07-20 2:09 ` Zhu Yi
0 siblings, 1 reply; 2+ messages in thread
From: Dan Carpenter @ 2009-07-19 11:53 UTC (permalink / raw)
To: yi.zhu; +Cc: linux-wireless
Hello,
I found this with a source code checker (http://repo.or.cz/w/smatch.git).
We free "cmd" on line 390 and then dereference it on line 396. I don't
know what we should return in that case or I would have sent a patch.
Sorry.
drivers/net/wireless/iwmc3200wifi/hal.c
390 if (!udma_cmd->resp)
391 kfree(cmd);
392
393 if (ret < 0)
394 return ret;
395
396 return cmd->seq_num;
regards,
dan carpenter
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: iwmc3200wifi: using freed memory in iwm_hal_send_target_cmd()
2009-07-19 11:53 iwmc3200wifi: using freed memory in iwm_hal_send_target_cmd() Dan Carpenter
@ 2009-07-20 2:09 ` Zhu Yi
0 siblings, 0 replies; 2+ messages in thread
From: Zhu Yi @ 2009-07-20 2:09 UTC (permalink / raw)
To: Dan Carpenter; +Cc: linux-wireless@vger.kernel.org
On Sun, 2009-07-19 at 19:53 +0800, Dan Carpenter wrote:
> Hello,
>
> I found this with a source code checker (http://repo.or.cz/w/smatch.git).
>
> We free "cmd" on line 390 and then dereference it on line 396. I don't
> know what we should return in that case or I would have sent a patch.
> Sorry.
>
> drivers/net/wireless/iwmc3200wifi/hal.c
> 390 if (!udma_cmd->resp)
> 391 kfree(cmd);
> 392
> 393 if (ret < 0)
> 394 return ret;
> 395
> 396 return cmd->seq_num;
Good catch! I'll send out a patch later.
Thanks,
-yi
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2009-07-20 2:09 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2009-07-19 11:53 iwmc3200wifi: using freed memory in iwm_hal_send_target_cmd() Dan Carpenter
2009-07-20 2:09 ` Zhu Yi
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).