diff options
| author |   Dan Carpenter <dan.carpenter@oracle.com> | 2014-04-10 12:36:13 +0300 |
|---|---|---|
| committer |   Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2014-04-16 11:41:44 -0700 |
| commit | d21bb45081484b95fb0c80f1afa492a7275689c2 (patch) | |
| tree | b654756bf0b4e5658b62880093fc68a0124d06a3 /drivers/staging | |
| parent | staging: speakup: fix misuse of kstrtol() in handle_goto() (diff) | |
| download | linux-dev-d21bb45081484b95fb0c80f1afa492a7275689c2.tar.xz linux-dev-d21bb45081484b95fb0c80f1afa492a7275689c2.zip | |
staging: unisys: use after free in error messages
We dereference "bus" when we report the error so we have to move the
kfree() down a couple lines.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/staging')
| -rw-r--r-- | drivers/staging/unisys/uislib/uislib.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/staging/unisys/uislib/uislib.c b/drivers/staging/unisys/uislib/uislib.c index 8ea9c46e56ae..3152a2180c45 100644 --- a/drivers/staging/unisys/uislib/uislib.c +++ b/drivers/staging/unisys/uislib/uislib.c @@ -381,17 +381,17 @@ create_bus(CONTROLVM_MESSAGE *msg, char *buf) cmd.add_vbus.busTypeGuid = msg->cmd.createBus.busDataTypeGuid; cmd.add_vbus.busInstGuid = msg->cmd.createBus.busInstGuid; if (!VirtControlChanFunc) { - kfree(bus); LOGERR("CONTROLVM_BUS_CREATE Failed: virtpci callback not registered."); POSTCODE_LINUX_3(BUS_CREATE_FAILURE_PC, bus->busNo, POSTCODE_SEVERITY_ERR); + kfree(bus); return CONTROLVM_RESP_ERROR_VIRTPCI_DRIVER_FAILURE; } if (!VirtControlChanFunc(&cmd)) { - kfree(bus); LOGERR("CONTROLVM_BUS_CREATE Failed: virtpci GUEST_ADD_VBUS returned error."); POSTCODE_LINUX_3(BUS_CREATE_FAILURE_PC, bus->busNo, POSTCODE_SEVERITY_ERR); + kfree(bus); return CONTROLVM_RESP_ERROR_VIRTPCI_DRIVER_CALLBACK_ERROR; } |