lkml.org 
[lkml]   [2019]   [Nov]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 033/105] can: usb_8dev: fix use-after-free on disconnect
    Date
    From: Johan Hovold <johan@kernel.org>

    commit 3759739426186a924675651b388d1c3963c5710e upstream.

    The driver was accessing its driver data after having freed it.

    Fixes: 0024d8ad1639 ("can: usb_8dev: Add support for USB2CAN interface from 8 devices")
    Cc: stable <stable@vger.kernel.org> # 3.9
    Cc: Bernd Krumboeck <b.krumboeck@gmail.com>
    Cc: Wolfgang Grandegger <wg@grandegger.com>
    Signed-off-by: Johan Hovold <johan@kernel.org>
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/net/can/usb/usb_8dev.c | 3 +--
    1 file changed, 1 insertion(+), 2 deletions(-)

    --- a/drivers/net/can/usb/usb_8dev.c
    +++ b/drivers/net/can/usb/usb_8dev.c
    @@ -1007,9 +1007,8 @@ static void usb_8dev_disconnect(struct u
    netdev_info(priv->netdev, "device disconnected\n");

    unregister_netdev(priv->netdev);
    - free_candev(priv->netdev);
    -
    unlink_all_urbs(priv);
    + free_candev(priv->netdev);
    }

    }

    \
     
     \ /
      Last update: 2019-11-11 20:08    [W:4.394 / U:0.004 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site