github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-06-09 23:23:53 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

NFC: pn533: Fix use after free

Browse Source 
commit 770f750bc2 upstream.

cmd was freed in pn533_dep_link_up regardless of
pn533_send_cmd_frame_async return code. Cmd is passed as argument to
pn533_in_dep_link_up_complete callback and should be freed there.

Signed-off-by: Szymon Janc <szymon.janc@tieto.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
Signed-off-by: Peter Huewe <peterhuewe@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Szymon Janc 2012-10-29 14:04:43 +01:00 committed by Greg Kroah-Hartman
parent 9cfb66219d
commit c09221cefd
1 changed files with 2 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
drivers/nfc/pn533.c
View File

@ -1385,12 +1385,8 @@ static int pn533_dep_link_up(struct nfc_dev *nfc_dev, int target_idx,
rc = pn533_send_cmd_frame_async(dev, dev->out_frame, dev->in_frame,
dev->in_maxlen, pn533_in_dep_link_up_complete,
cmd, GFP_KERNEL);
if (rc)
goto out;
out:
kfree(cmd);
if (rc < 0)
kfree(cmd);
return rc;
}