Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d21bb450 authored by Dan Carpenter's avatar Dan Carpenter Committed by Greg Kroah-Hartman
Browse files

staging: unisys: use after free in error messages 



We dereference "bus" when we report the error so we have to move the
kfree() down a couple lines.

Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent ef35a4f4

drivers/staging/unisys/uislib/uislib.c

+2 −2
Original line number Diff line number Diff line
@@ -381,17 +381,17 @@ create_bus(CONTROLVM_MESSAGE *msg, char *buf) 
		cmd.add_vbus.busTypeGuid = msg->cmd.createBus.busDataTypeGuid;

		cmd.add_vbus.busInstGuid = msg->cmd.createBus.busInstGuid;

		if (!VirtControlChanFunc) {

			kfree(bus);

			LOGERR("CONTROLVM_BUS_CREATE Failed: virtpci callback not registered.");

			POSTCODE_LINUX_3(BUS_CREATE_FAILURE_PC, bus->busNo,

					 POSTCODE_SEVERITY_ERR);

			kfree(bus);

			return CONTROLVM_RESP_ERROR_VIRTPCI_DRIVER_FAILURE;

		}

		if (!VirtControlChanFunc(&cmd)) {

			kfree(bus);

			LOGERR("CONTROLVM_BUS_CREATE Failed: virtpci GUEST_ADD_VBUS returned error.");

			POSTCODE_LINUX_3(BUS_CREATE_FAILURE_PC, bus->busNo,

					 POSTCODE_SEVERITY_ERR);

			kfree(bus);

			return

			    CONTROLVM_RESP_ERROR_VIRTPCI_DRIVER_CALLBACK_ERROR;

		}