From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Date: Wed, 24 May 2017 00:07:43 +0000 (-0700)
Subject: firmware: vpd: avoid potential use-after-free when destroying section
X-Git-Url: http://git.cdn.openwrt.org/?a=commitdiff_plain;h=ce57cba37f3721c21e46adf21c61292dfd7a9c04;p=openwrt%2Fstaging%2Fblogic.git

firmware: vpd: avoid potential use-after-free when destroying section

We should not free info->key before we remove sysfs attribute that uses
this data as its name.

Fixes: 049a59db34eb ("firmware: Google VPD sysfs driver")
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Reviewed-by: Guenter Roeck <groeck@chromium.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---

diff --git a/drivers/firmware/google/vpd.c b/drivers/firmware/google/vpd.c
index 23a24a6d02c2..db49c6f98153 100644
--- a/drivers/firmware/google/vpd.c
+++ b/drivers/firmware/google/vpd.c
@@ -158,8 +158,8 @@ static void vpd_section_attrib_destroy(struct vpd_section *sec)
 	struct vpd_attrib_info *temp;
 
 	list_for_each_entry_safe(info, temp, &sec->attribs, list) {
-		kfree(info->key);
 		sysfs_remove_bin_file(sec->kobj, &info->bin_attr);
+		kfree(info->key);
 		kfree(info);
 	}
 }