staging/gdm72xx: potential use after free in send_qos_list()

PATCH New Dan Carpenter 1 participant 1 message Jul 22, 2013

Subsystems (2)

Staging Kernel janitors

lore

Share & tools

lore

Dan Carpenter

author

2013-07-22 08:00 UTC #0 lore raw

PATCH 1/1 staging/gdm72xx: potential use after free in send_qos_list()

Sometimes free_qos_entry() sometimes frees its argument. I have moved the dereference of "entry" ahead on line to avoid a use after free.

Signed-off-by Dan Carpenter <[email protected]>

drivers/staging/gdm72xx/gdm_qos.c +1 -1

index b795353..cc36924 100644
@@ -250,8 +250,8 @@ static void send_qos_list(struct nic *nic, struct list_head *head)
 
 	list_for_each_entry_safe(entry, n, head, list) {
 		list_del(&entry->list);
-		free_qos_entry(entry);
 		gdm_wimax_send_tx(entry->skb, entry->dev);
+		free_qos_entry(entry);
 	}
 }