[patch -target tree] usb: gadget: f_tcm: use after free

From	Dan Carpenter <dan.carpenter@oracle.com>
Newsgroups	linux.kernel
Subject	[patch -target tree] usb: gadget: f_tcm: use after free
Date	2016-03-02 11:10 +0100
Message-ID	<r8bTd-6bA-11@gated-at.bofh.it> (permalink)
Organization	linux.* mail to news gateway

Show all headers | View raw

We need to move the kfree() down a line so we don't dereference a freed
variable.

Fixes: 1b418a8fcbc0 ('target: Convert demo-mode only drivers to target_alloc_session')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

diff --git a/drivers/usb/gadget/function/f_tcm.c b/drivers/usb/gadget/function/f_tcm.c
index 7276a73..e352a31 100644
--- a/drivers/usb/gadget/function/f_tcm.c
+++ b/drivers/usb/gadget/function/f_tcm.c
@@ -1596,8 +1596,8 @@ static int tcm_usbg_make_nexus(struct usbg_tpg *tpg, char *name)
 #define MAKE_NEXUS_MSG "core_tpg_check_initiator_node_acl() failed for %s\n"
 		pr_debug(MAKE_NEXUS_MSG, name);
 #undef MAKE_NEXUS_MSG
-		kfree(tv_nexus);
 		ret = PTR_ERR(tv_nexus->tvn_se_sess);
+		kfree(tv_nexus);
 	}
 
 out_unlock:

Back to linux.kernel | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

[patch -target tree] usb: gadget: f_tcm: use after free Dan Carpenter <dan.carpenter@oracle.com> - 2016-03-02 11:10 +0100
  Re: [patch -target tree] usb: gadget: f_tcm: use after free Felipe Balbi <balbi@kernel.org> - 2016-03-02 13:00 +0100

csiph-web