diff options
| author | David S. Miller <davem@davemloft.net> | 2016-12-08 18:22:40 -0500 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2016-12-08 18:22:40 -0500 |
| commit | 1e97426d29fec42e559d12cdb069c83962be762e (patch) | |
| tree | ab118a005f9501f87bd449ee0998300f51752dff /drivers/net | |
| parent | d2a007ab191646d41553ffb6624cef1957e899ae (diff) | |
| parent | b67d0dd7d0dc9e456825447bbeb935d8ef43ea7c (diff) | |
| download | linux-1e97426d29fec42e559d12cdb069c83962be762e.tar.bz2 | |
Merge tag 'linux-can-fixes-for-4.9-20161208' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can
Marc Kleine-Budde says:
====================
pull-request: can 2016-12-08
this is a pull request for one patch.
Jiho Chu found and fixed a use-after-free error in the cleanup path in
the peak pcan USB CAN driver.
====================
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net')
| -rw-r--r-- | drivers/net/can/usb/peak_usb/pcan_usb_core.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_core.c b/drivers/net/can/usb/peak_usb/pcan_usb_core.c index f3141ca56bc3..0b0302af3bd2 100644 --- a/drivers/net/can/usb/peak_usb/pcan_usb_core.c +++ b/drivers/net/can/usb/peak_usb/pcan_usb_core.c @@ -870,23 +870,25 @@ lbl_free_candev: static void peak_usb_disconnect(struct usb_interface *intf) { struct peak_usb_device *dev; + struct peak_usb_device *dev_prev_siblings; /* unregister as many netdev devices as siblings */ - for (dev = usb_get_intfdata(intf); dev; dev = dev->prev_siblings) { + for (dev = usb_get_intfdata(intf); dev; dev = dev_prev_siblings) { struct net_device *netdev = dev->netdev; char name[IFNAMSIZ]; + dev_prev_siblings = dev->prev_siblings; dev->state &= ~PCAN_USB_STATE_CONNECTED; strncpy(name, netdev->name, IFNAMSIZ); unregister_netdev(netdev); - free_candev(netdev); kfree(dev->cmd_buf); dev->next_siblings = NULL; if (dev->adapter->dev_free) dev->adapter->dev_free(dev); + free_candev(netdev); dev_info(&intf->dev, "%s removed\n", name); } |