Staging: bcm: avoid use-after-free in bcm_char_ioctl()

Free pBulkBuffer (pvBuffer) after pBulkBuffer->Register.

Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/staging/bcm/Bcmchar.c b/drivers/staging/bcm/Bcmchar.c
index 491e2bfbc46487a51cbb4e62ef71613876b0cddb..35641e529396759d5e7c860457155b28fde21f94 100644 (file)
--- a/drivers/staging/bcm/Bcmchar.c
+++ b/drivers/staging/bcm/Bcmchar.c
@@ -1148,8 +1148,8 @@ cntrlEnd:
 
                if (((ULONG)pBulkBuffer->Register & 0x0F000000) != 0x0F000000 ||
                        ((ULONG)pBulkBuffer->Register & 0x3)) {
-                       kfree(pvBuffer);
                        BCM_DEBUG_PRINT (Adapter, DBG_TYPE_PRINTK, 0, 0, "WRM Done On invalid Address : %x Access Denied.\n", (int)pBulkBuffer->Register);
+                       kfree(pvBuffer);
                        Status = -EINVAL;
                        break;
                }