Selaa lähdekoodia

serial: icom: dereference after free in load_code()

We use "fw" in the next line after we release it.  I've shifted the call
to release_firmware() down a couple lines to fix this.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Dan Carpenter 12 vuotta sitten
vanhempi
commit
d6a62b3b7e
1 muutettua tiedostoa jossa 2 lisäystä ja 2 poistoa
  1. 2 2
      drivers/tty/serial/icom.c

+ 2 - 2
drivers/tty/serial/icom.c

@@ -455,11 +455,11 @@ static void load_code(struct icom_port *icom_port)
 	for (index = 0; index < fw->size; index++)
 	for (index = 0; index < fw->size; index++)
 		new_page[index] = fw->data[index];
 		new_page[index] = fw->data[index];
 
 
-	release_firmware(fw);
-
 	writeb((char) ((fw->size + 16)/16), &icom_port->dram->mac_length);
 	writeb((char) ((fw->size + 16)/16), &icom_port->dram->mac_length);
 	writel(temp_pci, &icom_port->dram->mac_load_addr);
 	writel(temp_pci, &icom_port->dram->mac_load_addr);
 
 
+	release_firmware(fw);
+
 	/*Setting the syncReg to 0x80 causes adapter to start downloading
 	/*Setting the syncReg to 0x80 causes adapter to start downloading
 	   the personality code into adapter instruction RAM.
 	   the personality code into adapter instruction RAM.
 	   Once code is loaded, it will begin executing and, based on
 	   Once code is loaded, it will begin executing and, based on