diff options
| author |   David S. Miller <davem@davemloft.net> | 2018-03-20 12:42:36 -0400 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2018-03-20 12:42:36 -0400 |
| commit | 8220ce6d1b510abfa1cbb3379d05577118ac8c23 (patch) | |
| tree | c5b3408f61acace1926c4416c0a2df9b2c41e034 /drivers | |
| parent | net: gemini: fix memory leak (diff) | |
| parent | can: cc770: Fix use after free in cc770_tx_interrupt() (diff) | |
| download | linux-dev-8220ce6d1b510abfa1cbb3379d05577118ac8c23.tar.xz linux-dev-8220ce6d1b510abfa1cbb3379d05577118ac8c23.zip | |
Merge tag 'linux-can-fixes-for-4.16-20180319' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can
Marc Kleine-Budde says:
====================
pull-request: can 2018-03-19
this is a pull reqeust of one patch for net/master.
The patch is by Andri Yngvason and fixes a potential use-after-free bug
in the cc770 driver introduced in the previous pull-request.
====================
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/net/can/cc770/cc770.c | 5 |
1 files changed, 2 insertions, 3 deletions
diff --git a/drivers/net/can/cc770/cc770.c b/drivers/net/can/cc770/cc770.c index 2743d82d4424..6da69af103e6 100644 --- a/drivers/net/can/cc770/cc770.c +++ b/drivers/net/can/cc770/cc770.c @@ -706,13 +706,12 @@ static void cc770_tx_interrupt(struct net_device *dev, unsigned int o) return; } - can_put_echo_skb(priv->tx_skb, dev, 0); - can_get_echo_skb(dev, 0); - cf = (struct can_frame *)priv->tx_skb->data; stats->tx_bytes += cf->can_dlc; stats->tx_packets++; + can_put_echo_skb(priv->tx_skb, dev, 0); + can_get_echo_skb(dev, 0); priv->tx_skb = NULL; netif_wake_queue(dev); |