[patch 03/26] drivers/infiniband/core/mad.c: fix a use-after-free

From: Greg KH
Date: Tue Dec 13 2005 - 03:26:59 EST


-stable review patch. If anyone has any objections, please let us know.

------------------
From: Adrian Bunk <bunk@xxxxxxxxx>

The Coverity checker spotted this obvious use-after-free
caused by a wrong order of the cleanups.

Signed-off-by: Adrian Bunk <bunk@xxxxxxxxx>
Acked-by: Roland Dreier <rolandd@xxxxxxxxx>
Signed-off-by: Chris Wright <chrisw@xxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxx>
---
drivers/infiniband/core/mad.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

--- linux-2.6.14.3.orig/drivers/infiniband/core/mad.c
+++ linux-2.6.14.3/drivers/infiniband/core/mad.c
@@ -356,9 +356,9 @@ error4:
spin_unlock_irqrestore(&port_priv->reg_lock, flags);
kfree(reg_req);
error3:
- kfree(mad_agent_priv);
-error2:
ib_dereg_mr(mad_agent_priv->agent.mr);
+error2:
+ kfree(mad_agent_priv);
error1:
return ret;
}

--
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/