diff options
| author | Everest K.C. <everestkc@everestkc.com.np> | 2024-10-16 00:51:55 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2024-10-16 10:55:31 +0300 |
| commit | b0a7dfeb7df670bb8603e043c9634aa9eda42a49 (patch) | |
| tree | aea34fbd26fc1fa1ac5dee40d0b5ed05321250fe | |
| parent | afa0ab042efe968c0f234239cbaeede6f5779c86 (diff) | |
| download | linux-b0a7dfeb7df670bb8603e043c9634aa9eda42a49.tar.xz | |
staging: gpib: Move free after the variable use has been completed
The variable `in_data` is freed, but used later in the code.
Fix it by moving the freeing the memory after it use has been
completed.
This issue was reported by Coverity Scan.
Report:
CID 1600783: (#1 of 1): Use after free (USE_AFTER_FREE)
19. pass_freed_arg: Passing freed pointer in_data as an argument to
ni_usb_dump_raw_block.
Fixes: 4e127de14fa7 ("staging: gpib: Add National Instruments USB GPIB driver")
Signed-off-by: Everest K.C. <everestkc@everestkc.com.np>
Reviewed-by: Shuah Khan <skhan@linuxfoundation.org>
Link: https://lore.kernel.org/r/20241015215157.18571-1-everestkc@everestkc.com.np
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | drivers/staging/gpib/ni_usb/ni_usb_gpib.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/staging/gpib/ni_usb/ni_usb_gpib.c b/drivers/staging/gpib/ni_usb/ni_usb_gpib.c index 1da263676f2a..75f39e1f3ed1 100644 --- a/drivers/staging/gpib/ni_usb/ni_usb_gpib.c +++ b/drivers/staging/gpib/ni_usb/ni_usb_gpib.c @@ -690,12 +690,12 @@ static int ni_usb_read(gpib_board_t *board, uint8_t *buffer, size_t length, kfree(in_data); return parse_retval; } - kfree(in_data); if (actual_length != length - status.count) { pr_err("%s: actual_length=%i expected=%li\n", __func__, actual_length, (long)(length - status.count)); ni_usb_dump_raw_block(in_data, usb_bytes_read); } + kfree(in_data); switch (status.error_code) { case NIUSB_NO_ERROR: retval = 0; |