question about drivers/serial/sunsu.c

[Julia Lawall <julia@xxxxxxx>]

The following function in drivers/serial/sunsu.c contains a possible use 
after free:

static int __devexit su_remove(struct of_device *op)
{
        struct uart_sunsu_port *up = dev_get_drvdata(&op->dev);

        if (up->su_type == SU_PORT_MS ||
            up->su_type == SU_PORT_KBD) {
#ifdef CONFIG_SERIO
                serio_unregister_port(&up->serio);
#endif
                kfree(up);
        } else if (up->port.type != PORT_UNKNOWN) {
                uart_remove_one_port(&sunsu_reg, &up->port);
        }

        if (up->port.membase)
                of_iounmap(&op->resource[0], up->port.membase, up->reg_size);

        dev_set_drvdata(&op->dev, NULL);

        return 0;
}

Is it safe to simply move the if (up->port.membase) of_iounmap(...); up 
above the other ifs, or should something else be done?

thanks,
julia
--
To unsubscribe from this list: send the line "unsubscribe sparclinux" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html