asgardius/android_kernel_motorola_sm6225
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

serial: icom: dereference after free in load_code()

Browse source 
We use "fw" in the next line after we release it.  I've shifted the call
to release_firmware() down a couple lines to fix this.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Dan Carpenter 2013-11-08 12:53:48 +03:00 committed by Greg Kroah-Hartman
parent 50a22ba074
commit d6a62b3b7e
1 changed files with 2 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
drivers/tty/serial/icom.c
View file

@ -455,11 +455,11 @@ static void load_code(struct icom_port *icom_port)
for (index = 0; index < fw->size; index++) for (index = 0; index < fw->size; index++)
new_page[index] = fw->data[index]; new_page[index] = fw->data[index];
release_firmware(fw);
writeb((char) ((fw->size + 16)/16), &icom_port->dram->mac_length); writeb((char) ((fw->size + 16)/16), &icom_port->dram->mac_length);
writel(temp_pci, &icom_port->dram->mac_load_addr); writel(temp_pci, &icom_port->dram->mac_load_addr);
release_firmware(fw);
/*Setting the syncReg to 0x80 causes adapter to start downloading /*Setting the syncReg to 0x80 causes adapter to start downloading
the personality code into adapter instruction RAM. the personality code into adapter instruction RAM.
Once code is loaded, it will begin executing and, based on Once code is loaded, it will begin executing and, based on