| From b535917c51acc97fb0761b1edec85f1f3d02bda4 Mon Sep 17 00:00:00 2001 |
| From: Dan Carpenter <dan.carpenter@oracle.com> |
| Date: Wed, 17 Nov 2021 10:20:16 +0300 |
| Subject: staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect() |
| |
| From: Dan Carpenter <dan.carpenter@oracle.com> |
| |
| commit b535917c51acc97fb0761b1edec85f1f3d02bda4 upstream. |
| |
| The free_rtllib() function frees the "dev" pointer so there is use |
| after free on the next line. Re-arrange things to avoid that. |
| |
| Fixes: 66898177e7e5 ("staging: rtl8192e: Fix unload/reload problem") |
| Cc: stable <stable@vger.kernel.org> |
| Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> |
| Link: https://lore.kernel.org/r/20211117072016.GA5237@kili |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| drivers/staging/rtl8192e/rtl8192e/rtl_core.c | 3 ++- |
| 1 file changed, 2 insertions(+), 1 deletion(-) |
| |
| --- a/drivers/staging/rtl8192e/rtl8192e/rtl_core.c |
| +++ b/drivers/staging/rtl8192e/rtl8192e/rtl_core.c |
| @@ -2712,13 +2712,14 @@ static void _rtl92e_pci_disconnect(struc |
| free_irq(dev->irq, dev); |
| priv->irq = 0; |
| } |
| - free_rtllib(dev); |
| |
| if (dev->mem_start != 0) { |
| iounmap((void __iomem *)dev->mem_start); |
| release_mem_region(pci_resource_start(pdev, 1), |
| pci_resource_len(pdev, 1)); |
| } |
| + |
| + free_rtllib(dev); |
| } else { |
| priv = rtllib_priv(dev); |
| } |
