Staging: bcm: avoid use-after-free in bcm_char_ioctl()

Free pBulkBuffer (pvBuffer) after pBulkBuffer->Register. Signed-off-by: Xi Wang <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
akeromi · Mar 11, 2013 · 075dd9b · 075dd9b
1 parent eb1bd49
commit 075dd9b
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/drivers/staging/bcm/Bcmchar.c b/drivers/staging/bcm/Bcmchar.c
@@ -1148,8 +1148,8 @@ static long bcm_char_ioctl(struct file *filp, UINT cmd, ULONG arg)
 
 		if (((ULONG)pBulkBuffer->Register & 0x0F000000) != 0x0F000000 ||
 			((ULONG)pBulkBuffer->Register & 0x3)) {
-			kfree(pvBuffer);
 			BCM_DEBUG_PRINT (Adapter, DBG_TYPE_PRINTK, 0, 0, "WRM Done On invalid Address : %x Access Denied.\n", (int)pBulkBuffer->Register);
+			kfree(pvBuffer);
 			Status = -EINVAL;
 			break;
 		}