staging: unisys: use after free in error messages

We dereference "bus" when we report the error so we have to move the
kfree() down a couple lines.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/staging/unisys/uislib/uislib.c b/drivers/staging/unisys/uislib/uislib.c
index 8ea9c46e56aef55ba9603baa3e7700278cb1e13d..3152a2180c456c0d9e06ee64333f6352964ca982 100644 (file)
--- a/drivers/staging/unisys/uislib/uislib.c
+++ b/drivers/staging/unisys/uislib/uislib.c
@@ -381,17 +381,17 @@ create_bus(CONTROLVM_MESSAGE *msg, char *buf)
                cmd.add_vbus.busTypeGuid = msg->cmd.createBus.busDataTypeGuid;
                cmd.add_vbus.busInstGuid = msg->cmd.createBus.busInstGuid;
                if (!VirtControlChanFunc) {
-                       kfree(bus);
                        LOGERR("CONTROLVM_BUS_CREATE Failed: virtpci callback not registered.");
                        POSTCODE_LINUX_3(BUS_CREATE_FAILURE_PC, bus->busNo,
                                         POSTCODE_SEVERITY_ERR);
+                       kfree(bus);
                        return CONTROLVM_RESP_ERROR_VIRTPCI_DRIVER_FAILURE;
                }
                if (!VirtControlChanFunc(&cmd)) {
-                       kfree(bus);
                        LOGERR("CONTROLVM_BUS_CREATE Failed: virtpci GUEST_ADD_VBUS returned error.");
                        POSTCODE_LINUX_3(BUS_CREATE_FAILURE_PC, bus->busNo,
                                         POSTCODE_SEVERITY_ERR);
+                       kfree(bus);
                        return
                            CONTROLVM_RESP_ERROR_VIRTPCI_DRIVER_CALLBACK_ERROR;
                }