diff mbox

isdn: gigaset: use after free

Message ID 20100806082126.GT9031@bicker
State Accepted, archived
Delegated to: David Miller
Headers show

Commit Message

Dan Carpenter Aug. 6, 2010, 8:21 a.m. UTC 
I moved the kfree(cb) below the dereferences.

Signed-off-by: Dan Carpenter <error27@gmail.com>

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Comments

David Miller Aug. 8, 2010, 6:04 a.m. UTC | #1 
From: Dan Carpenter <error27@gmail.com>
Date: Fri, 6 Aug 2010 10:21:26 +0200

> I moved the kfree(cb) below the dereferences.
> 
> Signed-off-by: Dan Carpenter <error27@gmail.com>

Applied.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Tilman Schmidt Aug. 8, 2010, 12:55 p.m. UTC | #2 
Am 06.08.2010 10:21 schrieb Dan Carpenter:
> I moved the kfree(cb) below the dereferences.

Thanks for finding and fixing that bug.

> Signed-off-by: Dan Carpenter <error27@gmail.com>

Acked-by: Tilman Schmidt <tilman@imap.cc>

> diff --git a/drivers/isdn/gigaset/bas-gigaset.c b/drivers/isdn/gigaset/bas-gigaset.c
> index 0ded364..707d9c9 100644
> --- a/drivers/isdn/gigaset/bas-gigaset.c
> +++ b/drivers/isdn/gigaset/bas-gigaset.c
> @@ -1914,11 +1914,13 @@ static int gigaset_write_cmd(struct cardstate *cs, struct cmdbuf_t *cb)
>  	 * The next command will reopen the AT channel automatically.
>  	 */
>  	if (cb->len == 3 && !memcmp(cb->buf, "+++", 3)) {
> -		kfree(cb);
>  		rc = req_submit(cs->bcs, HD_CLOSE_ATCHANNEL, 0, BAS_TIMEOUT);
>  		if (cb->wake_tasklet)
>  			tasklet_schedule(cb->wake_tasklet);
> -		return rc < 0 ? rc : cb->len;
> +		if (!rc)
> +			rc = cb->len;
> +		kfree(cb);
> +		return rc;
>  	}
>  
>  	spin_lock_irqsave(&cs->cmdlock, flags);
diff mbox

Patch

diff --git a/drivers/isdn/gigaset/bas-gigaset.c b/drivers/isdn/gigaset/bas-gigaset.c
index 0ded364..707d9c9 100644
--- a/drivers/isdn/gigaset/bas-gigaset.c
+++ b/drivers/isdn/gigaset/bas-gigaset.c
@@ -1914,11 +1914,13 @@  static int gigaset_write_cmd(struct cardstate *cs, struct cmdbuf_t *cb)
 	 * The next command will reopen the AT channel automatically.
 	 */
 	if (cb->len == 3 && !memcmp(cb->buf, "+++", 3)) {
-		kfree(cb);
 		rc = req_submit(cs->bcs, HD_CLOSE_ATCHANNEL, 0, BAS_TIMEOUT);
 		if (cb->wake_tasklet)
 			tasklet_schedule(cb->wake_tasklet);
-		return rc < 0 ? rc : cb->len;
+		if (!rc)
+			rc = cb->len;
+		kfree(cb);
+		return rc;
 	}
 
 	spin_lock_irqsave(&cs->cmdlock, flags);