firewire: net: fix use after free

Commit 8408dc1 "firewire: net: use dev_printk API" introduced a use-after-free in a failure path. fwnet_transmit_packet_failed(ptask) may free ptask, then the dev_err() call dereferenced it. The fix is straightforward; simply reorder the two calls. Reported-by: Dan Carpenter <[email protected]> Cc: [email protected] # v3.4+ Signed-off-by: Stefan Richter <[email protected]>
raspberrypi · Feb 28, 2014 · 8987583 · 8987583
1 parent cfbf8d4
commit 8987583
Showing 1 changed file with 3 additions and 3 deletions.
diff --git a/drivers/firewire/net.c b/drivers/firewire/net.c
@@ -929,17 +929,17 @@ static void fwnet_write_complete(struct fw_card *card, int rcode,
 	if (rcode == RCODE_COMPLETE) {
 		fwnet_transmit_packet_done(ptask);
 	} else {
-		fwnet_transmit_packet_failed(ptask);
-
 		if (printk_timed_ratelimit(&j,  1000) || rcode != last_rcode) {
 			dev_err(&ptask->dev->netdev->dev,
 				"fwnet_write_complete failed: %x (skipped %d)\n",
 				rcode, errors_skipped);
 
 			errors_skipped = 0;
 			last_rcode = rcode;
-		} else
+		} else {
 			errors_skipped++;
+		}
+		fwnet_transmit_packet_failed(ptask);
 	}
 }