Skip to contentSkip to conversation

wl12xx: use after free in debug code

PATCH Applied Dan Carpenter 2 participants 2 messages Dec 21, 2010

Subsystems (2)
Kernel janitors Networking drivers (wireless)
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 wl12xx: use after free in debug code

If debugging is turned on, then wl1271_dump() dereferences a freed variable.

Signed-off-by Dan Carpenter <[email protected]>
drivers/net/wireless/wl12xx/spi.c +1 -1
index 4671491..8f7ea2c 100644
@@ -110,9 +110,9 @@ static void wl1271_spi_reset(struct wl1271 *wl)
 	spi_message_add_tail(&t, &m);
 
 	spi_sync(wl_to_spi(wl), &m);
-	kfree(cmd);
 
 	wl1271_dump(DEBUG_SPI, "spi reset -> ", cmd, WSPI_INIT_CMD_LEN);
+	kfree(cmd);
 }
 
 static void wl1271_spi_init(struct wl1271 *wl)