| From stable-bounces@linux.kernel.org Mon Nov 28 03:46:11 2005 |
| Date: Mon, 28 Nov 2005 12:46:00 +0100 |
| From: Adrian Bunk <bunk@stusta.de> |
| To: stable@kernel.org |
| Cc: |
| Subject: drivers/infiniband/core/mad.c: fix a use-after-free |
| |
| The Coverity checker spotted this obvious use-after-free |
| caused by a wrong order of the cleanups. |
| |
| Signed-off-by: Adrian Bunk <bunk@stusta.de> |
| Acked-by: Roland Dreier <rolandd@cisco.com> |
| Signed-off-by: Chris Wright <chrisw@osdl.org> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> |
| --- |
| drivers/infiniband/core/mad.c | 4 ++-- |
| 1 file changed, 2 insertions(+), 2 deletions(-) |
| |
| --- linux-2.6.14.3.orig/drivers/infiniband/core/mad.c |
| +++ linux-2.6.14.3/drivers/infiniband/core/mad.c |
| @@ -356,9 +356,9 @@ error4: |
| spin_unlock_irqrestore(&port_priv->reg_lock, flags); |
| kfree(reg_req); |
| error3: |
| - kfree(mad_agent_priv); |
| -error2: |
| ib_dereg_mr(mad_agent_priv->agent.mr); |
| +error2: |
| + kfree(mad_agent_priv); |
| error1: |
| return ret; |
| } |
