Re: [PATCH 3/8] firmware: vpd: avoid potential use-after-free when destroying section

[Guenter Roeck]

On Tue, May 23, 2017 at 5:07 PM, Dmitry Torokhov
<dmitry.torokhov@xxxxxxxxx> wrote:
> We should not free info->key before we remove sysfs attribute that uses
> this data as its name.
>
> Fixes: 049a59db34eb ("firmware: Google VPD sysfs driver")
> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@xxxxxxxxx>

Reviewed-by: Guenter Roeck <groeck@xxxxxxxxxxxx>

> ---
>  drivers/firmware/google/vpd.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/firmware/google/vpd.c b/drivers/firmware/google/vpd.c
> index acf3f3cdc3f8..b3a6e918418b 100644
> --- a/drivers/firmware/google/vpd.c
> +++ b/drivers/firmware/google/vpd.c
> @@ -157,8 +157,8 @@ static void vpd_section_attrib_destroy(struct vpd_section *sec)
>         struct vpd_attrib_info *temp;
>
>         list_for_each_entry_safe(info, temp, &sec->attribs, list) {
> -               kfree(info->key);
>                 sysfs_remove_bin_file(sec->kobj, &info->bin_attr);
> +               kfree(info->key);
>                 kfree(info);
>         }
>  }
> --
> 2.13.0.219.gdb65acc882-goog
>