evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Staging: bcm: avoid use-after-free in bcm_char_ioctl()

Browse source 
Free pBulkBuffer (pvBuffer) after pBulkBuffer->Register.

Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Xi Wang 2013-03-06 16:32:25 -05:00 • committed by Greg Kroah-Hartman
parent eb1bd49c50
commit 075dd9b83d
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
drivers/staging/bcm/Bcmchar.c
View file

@ -1148,8 +1148,8 @@ cntrlEnd:
if (((ULONG)pBulkBuffer->Register & 0x0F000000) != 0x0F000000 || if (((ULONG)pBulkBuffer->Register & 0x0F000000) != 0x0F000000 ||
((ULONG)pBulkBuffer->Register & 0x3)) { ((ULONG)pBulkBuffer->Register & 0x3)) {
kfree(pvBuffer);
BCM_DEBUG_PRINT (Adapter, DBG_TYPE_PRINTK, 0, 0, "WRM Done On invalid Address : %x Access Denied.\n", (int)pBulkBuffer->Register); BCM_DEBUG_PRINT (Adapter, DBG_TYPE_PRINTK, 0, 0, "WRM Done On invalid Address : %x Access Denied.\n", (int)pBulkBuffer->Register);
kfree(pvBuffer);
Status = -EINVAL; Status = -EINVAL;
break; break;
} }