Commit 9b00b415 authored Jan 30, 2011 by Mathias Krause Committed by John W. Linville Jan 31, 2011

wl12xx: fix use after free

When DEBUG_SPI is included in the debug log level wl1271_spi_reset()
will dump the already freed memory instead of the SPI buffer.

This bug was spotted by the semantic patch tool coccinelle using the
script found at scripts/coccinelle/free/kfree.cocci.

More information about semantic patching is available at
http://coccinelle.lip6.fr/



Signed-off-by: Mathias Krause <minipli@googlemail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

parent c7c18060

drivers/net/wireless/wl12xx/spi.c

+1 −2

Original line number	Original line	Diff line number	Diff line
	@@ -110,9 +110,8 @@ static void wl1271_spi_reset(struct wl1271 *wl)
	spi_message_add_tail(&t, &m);		spi_message_add_tail(&t, &m);

	spi_sync(wl_to_spi(wl), &m);		spi_sync(wl_to_spi(wl), &m);
	kfree(cmd);

	wl1271_dump(DEBUG_SPI, "spi reset -> ", cmd, WSPI_INIT_CMD_LEN);		wl1271_dump(DEBUG_SPI, "spi reset -> ", cmd, WSPI_INIT_CMD_LEN);
			kfree(cmd);
	}		}

	static void wl1271_spi_init(struct wl1271 *wl)		static void wl1271_spi_init(struct wl1271 *wl)