diff options
| author | Mathias Krause <minipli@googlemail.com> | 2011-01-30 11:29:47 +0100 |
|---|---|---|
| committer | John W. Linville <linville@tuxdriver.com> | 2011-01-31 14:48:15 -0500 |
| commit | 9b00b4157f7b3265de291ac8979a5f1611ce64ab (patch) | |
| tree | 88e0fda1bbae8516a89695cdefa30289e66555f6 | |
| parent | c7c1806098752c1f46943d8db2c69aff07f5d4bc (diff) | |
| download | linux-stable-9b00b4157f7b3265de291ac8979a5f1611ce64ab.tar.gz linux-stable-9b00b4157f7b3265de291ac8979a5f1611ce64ab.tar.bz2 linux-stable-9b00b4157f7b3265de291ac8979a5f1611ce64ab.zip | |
wl12xx: fix use after free
When DEBUG_SPI is included in the debug log level wl1271_spi_reset()
will dump the already freed memory instead of the SPI buffer.
This bug was spotted by the semantic patch tool coccinelle using the
script found at scripts/coccinelle/free/kfree.cocci.
More information about semantic patching is available at
http://coccinelle.lip6.fr/
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
| -rw-r--r-- | drivers/net/wireless/wl12xx/spi.c | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/drivers/net/wireless/wl12xx/spi.c b/drivers/net/wireless/wl12xx/spi.c index 46714910f98c..7145ea543783 100644 --- a/drivers/net/wireless/wl12xx/spi.c +++ b/drivers/net/wireless/wl12xx/spi.c @@ -110,9 +110,8 @@ static void wl1271_spi_reset(struct wl1271 *wl) spi_message_add_tail(&t, &m); spi_sync(wl_to_spi(wl), &m); - kfree(cmd); - wl1271_dump(DEBUG_SPI, "spi reset -> ", cmd, WSPI_INIT_CMD_LEN); + kfree(cmd); } static void wl1271_spi_init(struct wl1271 *wl) |