Преглед изворни кода

serial: icom: dereference after free in load_code()

We use "fw" in the next line after we release it.  I've shifted the call
to release_firmware() down a couple lines to fix this.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Dan Carpenter пре 11 година
родитељ
комит
d6a62b3b7e
1 измењених фајлова са 2 додато и 2 уклоњено
  1. 2 2
      drivers/tty/serial/icom.c

+ 2 - 2
drivers/tty/serial/icom.c

@@ -455,11 +455,11 @@ static void load_code(struct icom_port *icom_port)
 	for (index = 0; index < fw->size; index++)
 	for (index = 0; index < fw->size; index++)
 		new_page[index] = fw->data[index];
 		new_page[index] = fw->data[index];
 
 
-	release_firmware(fw);
-
 	writeb((char) ((fw->size + 16)/16), &icom_port->dram->mac_length);
 	writeb((char) ((fw->size + 16)/16), &icom_port->dram->mac_length);
 	writel(temp_pci, &icom_port->dram->mac_load_addr);
 	writel(temp_pci, &icom_port->dram->mac_load_addr);
 
 
+	release_firmware(fw);
+
 	/*Setting the syncReg to 0x80 causes adapter to start downloading
 	/*Setting the syncReg to 0x80 causes adapter to start downloading
 	   the personality code into adapter instruction RAM.
 	   the personality code into adapter instruction RAM.
 	   Once code is loaded, it will begin executing and, based on
 	   Once code is loaded, it will begin executing and, based on