linux-wireless.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [patch -next] wl12xx: use after free in debug code
@ 2010-12-21  4:00 Dan Carpenter
  2010-12-21  9:44 ` Luciano Coelho
  0 siblings, 1 reply; 2+ messages in thread
From: Dan Carpenter @ 2010-12-21  4:00 UTC (permalink / raw)
  To: John W. Linville
  Cc: Luciano Coelho, Shahar Levi, linux-wireless, kernel-janitors

If debugging is turned on, then wl1271_dump() dereferences a freed
variable.

Signed-off-by: Dan Carpenter <error27@gmail.com>

diff --git a/drivers/net/wireless/wl12xx/spi.c b/drivers/net/wireless/wl12xx/spi.c
index 4671491..8f7ea2c 100644
--- a/drivers/net/wireless/wl12xx/spi.c
+++ b/drivers/net/wireless/wl12xx/spi.c
@@ -110,9 +110,9 @@ static void wl1271_spi_reset(struct wl1271 *wl)
 	spi_message_add_tail(&t, &m);
 
 	spi_sync(wl_to_spi(wl), &m);
-	kfree(cmd);
 
 	wl1271_dump(DEBUG_SPI, "spi reset -> ", cmd, WSPI_INIT_CMD_LEN);
+	kfree(cmd);
 }
 
 static void wl1271_spi_init(struct wl1271 *wl)

^ permalink raw reply related	[flat|nested] 2+ messages in thread

* Re: [patch -next] wl12xx: use after free in debug code
  2010-12-21  4:00 [patch -next] wl12xx: use after free in debug code Dan Carpenter
@ 2010-12-21  9:44 ` Luciano Coelho
  0 siblings, 0 replies; 2+ messages in thread
From: Luciano Coelho @ 2010-12-21  9:44 UTC (permalink / raw)
  To: ext Dan Carpenter
  Cc: John W. Linville, Shahar Levi, linux-wireless, kernel-janitors

On Tue, 2010-12-21 at 07:00 +0300, ext Dan Carpenter wrote:
> If debugging is turned on, then wl1271_dump() dereferences a freed
> variable.
> 
> Signed-off-by: Dan Carpenter <error27@gmail.com>

Applied, thank you!


-- 
Cheers,
Luca.


^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, other threads:[~2010-12-21  9:49 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2010-12-21  4:00 [patch -next] wl12xx: use after free in debug code Dan Carpenter
2010-12-21  9:44 ` Luciano Coelho

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).