From 0dd386676497fb3097e6fbb3de6090c948c0df30 Mon Sep 17 00:00:00 2001 From: Dan Carpenter <error27@gmail.com> Date: Tue, 21 Dec 2010 07:00:13 +0300 Subject: [PATCH] wl12xx: use after free in debug code If debugging is turned on, then wl1271_dump() dereferences a freed variable. Signed-off-by: Dan Carpenter <error27@gmail.com> Signed-off-by: Luciano Coelho <luciano.coelho@nokia.com> --- drivers/net/wireless/wl12xx/spi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/wl12xx/spi.c b/drivers/net/wireless/wl12xx/spi.c index 46714910f98cc..8f7ea2c7d5671 100644 --- a/drivers/net/wireless/wl12xx/spi.c +++ b/drivers/net/wireless/wl12xx/spi.c @@ -110,9 +110,9 @@ static void wl1271_spi_reset(struct wl1271 *wl) spi_message_add_tail(&t, &m); spi_sync(wl_to_spi(wl), &m); - kfree(cmd); wl1271_dump(DEBUG_SPI, "spi reset -> ", cmd, WSPI_INIT_CMD_LEN); + kfree(cmd); } static void wl1271_spi_init(struct wl1271 *wl) -- 2.30.2