a7y18lte-ubports/android_kernel_samsung_universal7885
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

mkiss: Fix use after free in mkiss_close().

Browse Source 
Need to do the unregister_device() after all references to the driver
private have been done.

Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
David Miller 2015-12-17 16:05:49 -05:00 committed by David S. Miller
parent acf673a318
commit d79f16c046
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/net/hamradio/mkiss.c
View File

@ -798,13 +798,13 @@ static void mkiss_close(struct tty_struct *tty)
if (!atomic_dec_and_test(&ax->refcnt)) if (!atomic_dec_and_test(&ax->refcnt))
down(&ax->dead_sem); down(&ax->dead_sem);
unregister_netdev(ax->dev);
/* Free all AX25 frame buffers. */ /* Free all AX25 frame buffers. */
kfree(ax->rbuff); kfree(ax->rbuff);
kfree(ax->xbuff); kfree(ax->xbuff);
ax->tty = NULL; ax->tty = NULL;
unregister_netdev(ax->dev);
} }
/* Perform I/O control on an active ax25 channel. */ /* Perform I/O control on an active ax25 channel. */