aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorJohan Hovold <johan@kernel.org>2019-10-01 12:29:13 +0200
committerPaul Gortmaker <paul.gortmaker@windriver.com>2019-12-10 13:05:09 -0500
commita5f01eb4ae19683561f1590b71992e7ee104a240 (patch)
tree55c446ffc7ded147fde72e644c751de2638872aa
parentd440c83adfe290b35b6244882a75c3e022d0907d (diff)
downloadlinux-yocto-a5f01eb4ae19683561f1590b71992e7ee104a240.tar.gz
linux-yocto-a5f01eb4ae19683561f1590b71992e7ee104a240.tar.bz2
linux-yocto-a5f01eb4ae19683561f1590b71992e7ee104a240.zip
can: mcba_usb: fix use-after-free on disconnect
commit 4d6636498c41891d0482a914dd570343a838ad79 upstream. The driver was accessing its driver data after having freed it. Fixes: 51f3baad7de9 ("can: mcba_usb: Add support for Microchip CAN BUS Analyzer") Cc: stable <stable@vger.kernel.org> # 4.12 Cc: Remigiusz Kołłątaj <remigiusz.kollataj@mobica.com> Reported-by: syzbot+e29b17e5042bbc56fae9@syzkaller.appspotmail.com Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
-rw-r--r--drivers/net/can/usb/mcba_usb.c3
1 files changed, 1 insertions, 2 deletions
diff --git a/drivers/net/can/usb/mcba_usb.c b/drivers/net/can/usb/mcba_usb.c
index 19a702ac49e4..21faa2ec4632 100644
--- a/drivers/net/can/usb/mcba_usb.c
+++ b/drivers/net/can/usb/mcba_usb.c
@@ -876,9 +876,8 @@ static void mcba_usb_disconnect(struct usb_interface *intf)
netdev_info(priv->netdev, "device disconnected\n");
unregister_candev(priv->netdev);
- free_candev(priv->netdev);
-
mcba_urb_unlink(priv);
+ free_candev(priv->netdev);
}
static struct usb_driver mcba_usb_driver = {