tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
fork atom

UBI: fix some use after free bugs

Move the kmem_cache_free() calls down a couple lines.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>

authored by

Dan Carpenter and committed by
Artem Bityutskiy 5547fec7 38dbfb59

+4 -4
+4 -4
drivers/mtd/ubi/fastmap.c
··· 463 463 } 464 464 } 465 465 if (found_orphan) { 466 - kmem_cache_free(ai->aeb_slab_cache, tmp_aeb); 467 466 list_del(&tmp_aeb->u.list); 467 + kmem_cache_free(ai->aeb_slab_cache, tmp_aeb); 468 468 } 469 469 470 470 new_aeb = kmem_cache_alloc(ai->aeb_slab_cache, ··· 846 846 ret = UBI_BAD_FASTMAP; 847 847 fail: 848 848 list_for_each_entry_safe(tmp_aeb, _tmp_aeb, &used, u.list) { 849 - kmem_cache_free(ai->aeb_slab_cache, tmp_aeb); 850 849 list_del(&tmp_aeb->u.list); 850 + kmem_cache_free(ai->aeb_slab_cache, tmp_aeb); 851 851 } 852 852 list_for_each_entry_safe(tmp_aeb, _tmp_aeb, &eba_orphans, u.list) { 853 - kmem_cache_free(ai->aeb_slab_cache, tmp_aeb); 854 853 list_del(&tmp_aeb->u.list); 854 + kmem_cache_free(ai->aeb_slab_cache, tmp_aeb); 855 855 } 856 856 list_for_each_entry_safe(tmp_aeb, _tmp_aeb, &free, u.list) { 857 - kmem_cache_free(ai->aeb_slab_cache, tmp_aeb); 858 857 list_del(&tmp_aeb->u.list); 858 + kmem_cache_free(ai->aeb_slab_cache, tmp_aeb); 859 859 } 860 860 861 861 return ret;