commit 0dd386676497fb3097e6fbb3de6090c948c0df30
author Dan Carpenter <error27@gmail.com> Tue Dec 21 07:00:13 2010 +0300
committer Luciano Coelho <coelho@ti.com> Mon Jan 24 22:11:45 2011 +0200
tree b0726f021b9c744fc950ac0112b01a65a736ae15
parent 3c2c04a15f5fe5d169fe343c9eb7c1856d3033d3

wl12xx: use after free in debug code

If debugging is turned on, then wl1271_dump() dereferences a freed
variable.

Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Luciano Coelho <luciano.coelho@nokia.com>

drivers/net/wireless/wl12xx/spi.c

diff --git a/drivers/net/wireless/wl12xx/spi.c b/drivers/net/wireless/wl12xx/spi.c
index 4671491..8f7ea2c 100644
--- a/drivers/net/wireless/wl12xx/spi.c
+++ b/drivers/net/wireless/wl12xx/spi.c
@@ -110,9 +110,9 @@
 	spi_message_add_tail(&t, &m);
 
 	spi_sync(wl_to_spi(wl), &m);
-	kfree(cmd);
 
 	wl1271_dump(DEBUG_SPI, "spi reset -> ", cmd, WSPI_INIT_CMD_LEN);
+	kfree(cmd);
 }
 
 static void wl1271_spi_init(struct wl1271 *wl)