wl12xx: use after free in debug code
authorDan Carpenter <error27@gmail.com>
Tue, 21 Dec 2010 04:00:13 +0000 (07:00 +0300)
committerLuciano Coelho <coelho@ti.com>
Mon, 24 Jan 2011 20:11:45 +0000 (22:11 +0200)
If debugging is turned on, then wl1271_dump() dereferences a freed
variable.

Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Luciano Coelho <luciano.coelho@nokia.com>
drivers/net/wireless/wl12xx/spi.c

index 46714910f98ccb90f378ac33adce648bfabdf27c..8f7ea2c7d567131cfe4f353d21144db02027762d 100644 (file)
@@ -110,9 +110,9 @@ static void wl1271_spi_reset(struct wl1271 *wl)
        spi_message_add_tail(&t, &m);
 
        spi_sync(wl_to_spi(wl), &m);
-       kfree(cmd);
 
        wl1271_dump(DEBUG_SPI, "spi reset -> ", cmd, WSPI_INIT_CMD_LEN);
+       kfree(cmd);
 }
 
 static void wl1271_spi_init(struct wl1271 *wl)