staging: gdm72xx: potential use after free in send_qos_list()
authorDan Carpenter <dan.carpenter@oracle.com>
Mon, 22 Jul 2013 08:00:53 +0000 (11:00 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 23 Jul 2013 22:08:50 +0000 (15:08 -0700)
Sometimes free_qos_entry() sometimes frees its argument.  I have moved
the dereference of "entry" ahead on line to avoid a use after free.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/staging/gdm72xx/gdm_qos.c

index b795353e8348a3fcab6d1a01d0472a7168c370a1..cc3692439a5c95fedc0f2c584a52b3d03c0bf391 100644 (file)
@@ -250,8 +250,8 @@ static void send_qos_list(struct nic *nic, struct list_head *head)
 
        list_for_each_entry_safe(entry, n, head, list) {
                list_del(&entry->list);
-               free_qos_entry(entry);
                gdm_wimax_send_tx(entry->skb, entry->dev);
+               free_qos_entry(entry);
        }
 }