From: Adrian Bunk <bunk@stusta.de>
Date: Mon, 28 Nov 2005 11:46:00 +0000 (+0100)
Subject: [PATCH] drivers/infiniband/core/mad.c: fix a use-after-free
X-Git-Tag: v2.6.14.4~22
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=2d6eac6c4fdaa69656d66c80754d267be233cc3f;p=thirdparty%2Fkernel%2Fstable.git

[PATCH] drivers/infiniband/core/mad.c: fix a use-after-free

The Coverity checker spotted this obvious use-after-free
caused by a wrong order of the cleanups.

Signed-off-by: Adrian Bunk <bunk@stusta.de>
Acked-by: Roland Dreier <rolandd@cisco.com>
Signed-off-by: Chris Wright <chrisw@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---

diff --git a/drivers/infiniband/core/mad.c b/drivers/infiniband/core/mad.c
index a14ca87fda188..96855fceb2504 100644
--- a/drivers/infiniband/core/mad.c
+++ b/drivers/infiniband/core/mad.c
@@ -356,9 +356,9 @@ error4:
 	spin_unlock_irqrestore(&port_priv->reg_lock, flags);
 	kfree(reg_req);
 error3:
-	kfree(mad_agent_priv);
-error2:
 	ib_dereg_mr(mad_agent_priv->agent.mr);
+error2:
+	kfree(mad_agent_priv);
 error1:
 	return ret;
 }