diff options
| author | Dheeraj Reddy Jonnalagadda <dheeraj.linuxdev@gmail.com> | 2025-01-07 18:05:10 +0530 |
|---|---|---|
| committer | Jonathan Cameron <Jonathan.Cameron@huawei.com> | 2025-02-03 19:30:11 +0000 |
| commit | 5d702aa2a47bbab6231382f9ead5be40a287a53b (patch) | |
| tree | 85e25c2ef9b675666f70f80c49a21663862079fa | |
| parent | aa5119c36d19639397d29ef305aa53a5ecd72b27 (diff) | |
iio: proximity: Fix use-after-free in hx9023s_send_cfg()
Reorder the assignment of fw_size to happen before release_firmware()
to avoid accessing the firmware structure after it's been freed.
Fixes: e9ed97be4fcc ("iio: proximity: hx9023s: Added firmware file parsing functionality")
Closes: https://scan7.scan.coverity.com/#/project-view/52337/11354?selectedIssue=1602791
Signed-off-by: Dheeraj Reddy Jonnalagadda <dheeraj.linuxdev@gmail.com>
Reviewed-by: David Lechner <dlechner@baylibre.com>
Link: https://patch.msgid.link/20250107123510.44978-1-dheeraj.linuxdev@gmail.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
| -rw-r--r-- | drivers/iio/proximity/hx9023s.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/iio/proximity/hx9023s.c b/drivers/iio/proximity/hx9023s.c index e092a935dbac..5aa8e5a22f32 100644 --- a/drivers/iio/proximity/hx9023s.c +++ b/drivers/iio/proximity/hx9023s.c @@ -1036,12 +1036,13 @@ static int hx9023s_send_cfg(const struct firmware *fw, struct hx9023s_data *data return -ENOMEM; memcpy(bin->data, fw->data, fw->size); - release_firmware(fw); bin->fw_size = fw->size; bin->fw_ver = bin->data[FW_VER_OFFSET]; bin->reg_count = get_unaligned_le16(bin->data + FW_REG_CNT_OFFSET); + release_firmware(fw); + return hx9023s_bin_load(data, bin); } |