Skip to contentSkip to conversation

isdn: gigaset: use after free

PATCH Applied Dan Carpenter 3 participants 3 messages Aug 6, 2010 – Aug 8, 2010

Subsystems (3)
Networking Network drivers Kernel janitors
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 isdn: gigaset: use after free

I moved the kfree(cb) below the dereferences.

Signed-off-by Dan Carpenter <[email protected]>
drivers/isdn/gigaset/bas-gigaset.c +4 -2
index 0ded364..707d9c9 100644
@@ -1914,11 +1914,13 @@ static int gigaset_write_cmd(struct cardstate *cs, struct cmdbuf_t *cb)
 	 * The next command will reopen the AT channel automatically.
 	 */
 	if (cb->len = 3 && !memcmp(cb->buf, "+++", 3)) {
-		kfree(cb);
 		rc = req_submit(cs->bcs, HD_CLOSE_ATCHANNEL, 0, BAS_TIMEOUT);
 		if (cb->wake_tasklet)
 			tasklet_schedule(cb->wake_tasklet);
-		return rc < 0 ? rc : cb->len;
+		if (!rc)
+			rc = cb->len;
+		kfree(cb);
+		return rc;
 	}
 
 	spin_lock_irqsave(&cs->cmdlock, flags);
Acked-by on v1 1/1
#2 lore raw
In reply to Dan Carpenter

Am 06.08.2010 10:21 schrieb Dan Carpenter:

Quoted 1 line

I moved the kfree(cb) below the dereferences.

Thanks for finding and fixing that bug.

Quoted 1 line
Signed-off-by Dan Carpenter <[email protected]>
Acked-by Tilman Schmidt <[email protected]>
Quoted 20 lines
drivers/isdn/gigaset/bas-gigaset.c +4 -2
index 0ded364..707d9c9 100644
@@ -1914,11 +1914,13 @@ static int gigaset_write_cmd(struct cardstate *cs, struct cmdbuf_t *cb)
 	 * The next command will reopen the AT channel automatically.
 	 */
 	if (cb->len == 3 && !memcmp(cb->buf, "+++", 3)) {
-		kfree(cb);
 		rc = req_submit(cs->bcs, HD_CLOSE_ATCHANNEL, 0, BAS_TIMEOUT);
 		if (cb->wake_tasklet)
 			tasklet_schedule(cb->wake_tasklet);
-		return rc < 0 ? rc : cb->len;
+		if (!rc)
+			rc = cb->len;
+		kfree(cb);
+		return rc;
 	}
 
 	spin_lock_irqsave(&cs->cmdlock, flags);
Signature · 4 lines
Tilman Schmidt                    E-Mail: [email protected]
Bonn, Germany
Diese Nachricht besteht zu 100% aus wiederverwerteten Bits.
Ungeöffnet mindestens haltbar bis: (siehe Rückseite)