diff options
| author | Dmitry Torokhov <[email protected]> | 2017-05-24 00:07:43 +0000 |
|---|---|---|
| committer | Greg Kroah-Hartman <[email protected]> | 2017-05-25 13:37:16 +0000 |
| commit | ce57cba37f3721c21e46adf21c61292dfd7a9c04 (patch) | |
| tree | 99d4afe300e4bbecb1dca266a22de72b2dafa472 | |
| parent | firmware: vpd: do not leave freed section attributes to the list (diff) | |
| download | kernel-ce57cba37f3721c21e46adf21c61292dfd7a9c04.tar.gz kernel-ce57cba37f3721c21e46adf21c61292dfd7a9c04.zip | |
firmware: vpd: avoid potential use-after-free when destroying section
We should not free info->key before we remove sysfs attribute that uses
this data as its name.
Fixes: 049a59db34eb ("firmware: Google VPD sysfs driver")
Signed-off-by: Dmitry Torokhov <[email protected]>
Reviewed-by: Guenter Roeck <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
| -rw-r--r-- | drivers/firmware/google/vpd.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/firmware/google/vpd.c b/drivers/firmware/google/vpd.c index 23a24a6d02c2..db49c6f98153 100644 --- a/drivers/firmware/google/vpd.c +++ b/drivers/firmware/google/vpd.c @@ -158,8 +158,8 @@ static void vpd_section_attrib_destroy(struct vpd_section *sec) struct vpd_attrib_info *temp; list_for_each_entry_safe(info, temp, &sec->attribs, list) { - kfree(info->key); sysfs_remove_bin_file(sec->kobj, &info->bin_attr); + kfree(info->key); kfree(info); } } |