libertas: fix use-after-free error

Previously, the display of subscribed events could be wrong.

Signed-off-by: Holger Schurig <hs4233@mail.mn-solutions.de>
Signed-off-by: David Woodhouse <dwmw2@infradead.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

diff --git a/drivers/net/wireless/libertas/debugfs.c b/drivers/net/wireless/libertas/debugfs.c
index 745191a68962fb4eef97f1cfea031586f99f00c3..c5130a2581fef113b4acf9ab86fb6de722497536 100644 (file)
--- a/drivers/net/wireless/libertas/debugfs.c
+++ b/drivers/net/wireless/libertas/debugfs.c
@@ -410,30 +410,32 @@ static ssize_t lbs_threshold_read(
        char *buf = (char *)addr;
        u8 value;
        u8 freq;
+       int events = 0;
 
-       struct cmd_ds_802_11_subscribe_event *events = kzalloc(
+       struct cmd_ds_802_11_subscribe_event *subscribed = kzalloc(
                sizeof(struct cmd_ds_802_11_subscribe_event),
                GFP_KERNEL);
        struct mrvlietypes_thresholds *got;
 
        res = lbs_prepare_and_send_command(priv,
                        CMD_802_11_SUBSCRIBE_EVENT, CMD_ACT_GET,
-                       CMD_OPTION_WAITFORRSP, 0, events);
+                       CMD_OPTION_WAITFORRSP, 0, subscribed);
        if (res) {
-               kfree(events);
+               kfree(subscribed);
                return res;
        }
 
-       got = lbs_tlv_find(tlv_type, events->tlv, sizeof(events->tlv));
+       got = lbs_tlv_find(tlv_type, subscribed->tlv, sizeof(subscribed->tlv));
        if (got) {
                value = got->value;
                freq  = got->freq;
+               events = le16_to_cpu(subscribed->events);
        }
-       kfree(events);
+       kfree(subscribed);
 
        if (got)
                pos += snprintf(buf, len, "%d %d %d\n", value, freq,
-                       !!(le16_to_cpu(events->events) & event_mask));
+                       !!(events & event_mask));
 
        res = simple_read_from_buffer(userbuf, count, ppos, buf, pos);