linux-wireless.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* iwmc3200wifi: using freed memory in iwm_hal_send_target_cmd()
@ 2009-07-19 11:53 Dan Carpenter
  2009-07-20  2:09 ` Zhu Yi
  0 siblings, 1 reply; 2+ messages in thread
From: Dan Carpenter @ 2009-07-19 11:53 UTC (permalink / raw)
  To: yi.zhu; +Cc: linux-wireless

Hello,

I found this with a source code checker (http://repo.or.cz/w/smatch.git).

We free "cmd" on line 390 and then dereference it on line 396.  I don't 
know what we should return in that case or I would have sent a patch.  
Sorry.

drivers/net/wireless/iwmc3200wifi/hal.c
   390          if (!udma_cmd->resp)
   391                  kfree(cmd);
   392  
   393          if (ret < 0)
   394                  return ret;
   395  
   396          return cmd->seq_num;

regards,
dan carpenter

^ permalink raw reply	[flat|nested] 2+ messages in thread
end of thread, other threads:[~2009-07-20  2:09 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2009-07-19 11:53 iwmc3200wifi: using freed memory in iwm_hal_send_target_cmd() Dan Carpenter
2009-07-20  2:09 ` Zhu Yi

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).