free(device) before access to device->devId
|Reported by:||Owned by:||marcusoverhagen|
|Has a Patch:||no||Platform:||All|
In lines 645 (rtl8169_open()) and 691 (rtl8169_free()) in device.c from SVN revision 13218, the rtl8169_device pointer is freed before one of its members (devId) is accessed by the code that sets the device id as free.
The code in question reads:
free(device); atomic_and(&gOpenMask, ~(1 << device->devId));
And it should be instead set to:
atomic_and(&gOpenMask, ~(1 << device->devId)); free(device);