diff options
| author |   Dmitry Torokhov <dmitry.torokhov@gmail.com> | 2017-05-23 17:07:43 -0700 |
|---|---|---|
| committer |   Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2017-05-25 15:37:16 +0200 |
| commit | ce57cba37f3721c21e46adf21c61292dfd7a9c04 (patch) | |
| tree | 99d4afe300e4bbecb1dca266a22de72b2dafa472 /drivers/firmware/google | |
| parent | firmware: vpd: do not leave freed section attributes to the list (diff) | |
| download | linux-dev-ce57cba37f3721c21e46adf21c61292dfd7a9c04.tar.xz linux-dev-ce57cba37f3721c21e46adf21c61292dfd7a9c04.zip | |
firmware: vpd: avoid potential use-after-free when destroying section
We should not free info->key before we remove sysfs attribute that uses
this data as its name.
Fixes: 049a59db34eb ("firmware: Google VPD sysfs driver")
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Reviewed-by: Guenter Roeck <groeck@chromium.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/firmware/google')
| -rw-r--r-- | drivers/firmware/google/vpd.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/firmware/google/vpd.c b/drivers/firmware/google/vpd.c index 23a24a6d02c2..db49c6f98153 100644 --- a/drivers/firmware/google/vpd.c +++ b/drivers/firmware/google/vpd.c @@ -158,8 +158,8 @@ static void vpd_section_attrib_destroy(struct vpd_section *sec) struct vpd_attrib_info *temp; list_for_each_entry_safe(info, temp, &sec->attribs, list) { - kfree(info->key); sysfs_remove_bin_file(sec->kobj, &info->bin_attr); + kfree(info->key); kfree(info); } } |