Skip to content

Commit 5d702aa

Browse files
Dheeraj Reddy Jonnalagaddajic23
authored andcommitted
iio: proximity: Fix use-after-free in hx9023s_send_cfg()
Reorder the assignment of fw_size to happen before release_firmware() to avoid accessing the firmware structure after it's been freed. Fixes: e9ed97b ("iio: proximity: hx9023s: Added firmware file parsing functionality") Closes: https://scan7.scan.coverity.com/#/project-view/52337/11354?selectedIssue=1602791 Signed-off-by: Dheeraj Reddy Jonnalagadda <[email protected]> Reviewed-by: David Lechner <[email protected]> Link: https://patch.msgid.link/[email protected] Signed-off-by: Jonathan Cameron <[email protected]>
1 parent aa5119c commit 5d702aa

File tree

1 file changed

+2
-1
lines changed

1 file changed

+2
-1
lines changed

drivers/iio/proximity/hx9023s.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1036,12 +1036,13 @@ static int hx9023s_send_cfg(const struct firmware *fw, struct hx9023s_data *data
10361036
return -ENOMEM;
10371037

10381038
memcpy(bin->data, fw->data, fw->size);
1039-
release_firmware(fw);
10401039

10411040
bin->fw_size = fw->size;
10421041
bin->fw_ver = bin->data[FW_VER_OFFSET];
10431042
bin->reg_count = get_unaligned_le16(bin->data + FW_REG_CNT_OFFSET);
10441043

1044+
release_firmware(fw);
1045+
10451046
return hx9023s_bin_load(data, bin);
10461047
}
10471048

0 commit comments

Comments
 (0)