From: Xi Wang <xi.wang@gmail.com>
Date: Wed, 6 Mar 2013 21:32:25 +0000 (-0500)
Subject: Staging: bcm: avoid use-after-free in bcm_char_ioctl()
X-Git-Tag: v3.12-rc1~1000^2~789
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=075dd9b83da5bc54b53b23f6e315c19b54f2d800;p=kernel%2Fkernel-generic.git

Staging: bcm: avoid use-after-free in bcm_char_ioctl()

Free pBulkBuffer (pvBuffer) after pBulkBuffer->Register.

Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---

diff --git a/drivers/staging/bcm/Bcmchar.c b/drivers/staging/bcm/Bcmchar.c
index 491e2bf..35641e5 100644
--- a/drivers/staging/bcm/Bcmchar.c
+++ b/drivers/staging/bcm/Bcmchar.c
@@ -1148,8 +1148,8 @@ cntrlEnd:
 
 		if (((ULONG)pBulkBuffer->Register & 0x0F000000) != 0x0F000000 ||
 			((ULONG)pBulkBuffer->Register & 0x3)) {
-			kfree(pvBuffer);
 			BCM_DEBUG_PRINT (Adapter, DBG_TYPE_PRINTK, 0, 0, "WRM Done On invalid Address : %x Access Denied.\n", (int)pBulkBuffer->Register);
+			kfree(pvBuffer);
 			Status = -EINVAL;
 			break;
 		}