Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d6a62b3b authored by Dan Carpenter's avatar Dan Carpenter Committed by Greg Kroah-Hartman
Browse files

serial: icom: dereference after free in load_code() 



We use "fw" in the next line after we release it.  I've shifted the call
to release_firmware() down a couple lines to fix this.

Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 50a22ba0

drivers/tty/serial/icom.c

+2 −2
Original line number Original line Diff line number Diff line
@@ -455,11 +455,11 @@ static void load_code(struct icom_port *icom_port) 
	for (index = 0; index < fw->size; index++)

	for (index = 0; index < fw->size; index++)

		new_page[index] = fw->data[index];

		new_page[index] = fw->data[index];





	release_firmware(fw);



	writeb((char) ((fw->size + 16)/16), &icom_port->dram->mac_length);

	writeb((char) ((fw->size + 16)/16), &icom_port->dram->mac_length);

	writel(temp_pci, &icom_port->dram->mac_load_addr);

	writel(temp_pci, &icom_port->dram->mac_load_addr);





	release_firmware(fw);



	/*Setting the syncReg to 0x80 causes adapter to start downloading

	/*Setting the syncReg to 0x80 causes adapter to start downloading

	   the personality code into adapter instruction RAM.

	   the personality code into adapter instruction RAM.

	   Once code is loaded, it will begin executing and, based on

	   Once code is loaded, it will begin executing and, based on