lkml.org 
[lkml]   [2019]   [Nov]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.3 079/193] can: mcba_usb: fix use-after-free on disconnect
    Date
    From: Johan Hovold <johan@kernel.org>

    commit 4d6636498c41891d0482a914dd570343a838ad79 upstream.

    The driver was accessing its driver data after having freed it.

    Fixes: 51f3baad7de9 ("can: mcba_usb: Add support for Microchip CAN BUS Analyzer")
    Cc: stable <stable@vger.kernel.org> # 4.12
    Cc: Remigiusz Kołłątaj <remigiusz.kollataj@mobica.com>
    Reported-by: syzbot+e29b17e5042bbc56fae9@syzkaller.appspotmail.com
    Signed-off-by: Johan Hovold <johan@kernel.org>
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/net/can/usb/mcba_usb.c | 3 +--
    1 file changed, 1 insertion(+), 2 deletions(-)

    --- a/drivers/net/can/usb/mcba_usb.c
    +++ b/drivers/net/can/usb/mcba_usb.c
    @@ -876,9 +876,8 @@ static void mcba_usb_disconnect(struct u
    netdev_info(priv->netdev, "device disconnected\n");

    unregister_candev(priv->netdev);
    - free_candev(priv->netdev);
    -
    mcba_urb_unlink(priv);
    + free_candev(priv->netdev);
    }

    static struct usb_driver mcba_usb_driver = {

    \
     
     \ /
      Last update: 2019-11-11 19:52    [W:4.511 / U:0.140 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site