Commit b0a7dfeb authored by Everest K.C.'s avatar Everest K.C. Committed by Greg Kroah-Hartman
Browse files

staging: gpib: Move free after the variable use has been completed 



The variable `in_data` is freed, but used later in the code.
Fix it by moving the freeing the memory after it use has been
completed.

This issue was reported by Coverity Scan.
Report:
CID 1600783: (#1 of 1): Use after free (USE_AFTER_FREE)
19. pass_freed_arg: Passing freed pointer in_data as an argument to
ni_usb_dump_raw_block.

Fixes: 4e127de1 ("staging: gpib: Add National Instruments USB GPIB driver")
Signed-off-by: default avatarEverest K.C. <everestkc@everestkc.com.np>
Reviewed-by: default avatarShuah Khan <skhan@linuxfoundation.org>
Link: https://lore.kernel.org/r/20241015215157.18571-1-everestkc@everestkc.com.np


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent afa0ab04

drivers/staging/gpib/ni_usb/ni_usb_gpib.c

+1 −1
Original line number Diff line number Diff line
@@ -690,12 +690,12 @@ static int ni_usb_read(gpib_board_t *board, uint8_t *buffer, size_t length, 
		kfree(in_data);

		return parse_retval;

	}

	kfree(in_data);

	if (actual_length != length - status.count) {

		pr_err("%s: actual_length=%i expected=%li\n",

		       __func__, actual_length, (long)(length - status.count));

		ni_usb_dump_raw_block(in_data, usb_bytes_read);

	}

	kfree(in_data);

	switch (status.error_code) {

	case NIUSB_NO_ERROR:

		retval = 0;