Commit 21acee4e authored Jun 26, 2019 by Dan Carpenter Committed by Jiri Kosina Jun 26, 2019

HID: intel-ish-hid: Fix a use after free in load_fw_from_host()



We have to print the filename first before we can kfree it.

Fixes: 91b22810 ("HID: intel-ish-hid: ISH firmware loader client driver")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

parent 3ed224e2

drivers/hid/intel-ish-hid/ishtp-fw-loader.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -816,9 +816,9 @@ static int load_fw_from_host(struct ishtp_cl_data *client_data)
		goto end_err_fw_release;

		release_firmware(fw);
		kfree(filename);
		dev_info(cl_data_to_dev(client_data), "ISH firmware %s loaded\n",
		filename);
		kfree(filename);
		return 0;

		end_err_fw_release:

Admin message