Messages in this thread Patch in this message | | | Date | Fri, 18 Dec 2015 16:03:45 -0500 (EST) | Subject | Re: [PATCH 2/2] mkiss: Fix use after free in sixpack_close(). | From | David Miller <> |
| |
From: Ralf Baechle <ralf@linux-mips.org> Date: Thu, 17 Dec 2015 22:35:31 +0100
> On Thu, Dec 17, 2015 at 04:05:49PM -0500, David Miller wrote: > >> Subject: [PATCH 2/2] mkiss: Fix use after free in sixpack_close(). > > Make that subject "... mkiss_close()."
Durrr... indeed. Thanks for catching that.
Committed as follows:
==================== [PATCH] mkiss: Fix use after free in mkiss_close().
Need to do the unregister_device() after all references to the driver private have been done.
Signed-off-by: David S. Miller <davem@davemloft.net> --- drivers/net/hamradio/mkiss.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/hamradio/mkiss.c b/drivers/net/hamradio/mkiss.c index 216bfd3..0b72b9d 100644 --- a/drivers/net/hamradio/mkiss.c +++ b/drivers/net/hamradio/mkiss.c @@ -798,13 +798,13 @@ static void mkiss_close(struct tty_struct *tty) if (!atomic_dec_and_test(&ax->refcnt)) down(&ax->dead_sem); - unregister_netdev(ax->dev); - /* Free all AX25 frame buffers. */ kfree(ax->rbuff); kfree(ax->xbuff); ax->tty = NULL; + + unregister_netdev(ax->dev); } /* Perform I/O control on an active ax25 channel. */ -- 2.4.1
| |