diff options
| author |   추지호 <jiho.chu@samsung.com> | 2016-12-08 12:01:13 +0000 |
|---|---|---|
| committer |   Marc Kleine-Budde <mkl@pengutronix.de> | 2016-12-08 15:59:52 +0100 |
| commit | b67d0dd7d0dc9e456825447bbeb935d8ef43ea7c (patch) | |
| tree | 3f1d235deb384e3526ad5fc7cefce46159d7df11 /drivers | |
| parent | phy: Don't increment MDIO bus refcount unless it's a different owner (diff) | |
| download | linux-dev-b67d0dd7d0dc9e456825447bbeb935d8ef43ea7c.tar.xz linux-dev-b67d0dd7d0dc9e456825447bbeb935d8ef43ea7c.zip | |
can: peak: fix bad memory access and free sequence
Fix for bad memory access while disconnecting. netdev is freed before
private data free, and dev is accessed after freeing netdev.
This makes a slub problem, and it raise kernel oops with slub debugger
config.
Signed-off-by: Jiho Chu <jiho.chu@samsung.com>
Cc: linux-stable <stable@vger.kernel.org>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/net/can/usb/peak_usb/pcan_usb_core.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_core.c b/drivers/net/can/usb/peak_usb/pcan_usb_core.c index f3141ca56bc3..0b0302af3bd2 100644 --- a/drivers/net/can/usb/peak_usb/pcan_usb_core.c +++ b/drivers/net/can/usb/peak_usb/pcan_usb_core.c @@ -870,23 +870,25 @@ lbl_free_candev: static void peak_usb_disconnect(struct usb_interface *intf) { struct peak_usb_device *dev; + struct peak_usb_device *dev_prev_siblings; /* unregister as many netdev devices as siblings */ - for (dev = usb_get_intfdata(intf); dev; dev = dev->prev_siblings) { + for (dev = usb_get_intfdata(intf); dev; dev = dev_prev_siblings) { struct net_device *netdev = dev->netdev; char name[IFNAMSIZ]; + dev_prev_siblings = dev->prev_siblings; dev->state &= ~PCAN_USB_STATE_CONNECTED; strncpy(name, netdev->name, IFNAMSIZ); unregister_netdev(netdev); - free_candev(netdev); kfree(dev->cmd_buf); dev->next_siblings = NULL; if (dev->adapter->dev_free) dev->adapter->dev_free(dev); + free_candev(netdev); dev_info(&intf->dev, "%s removed\n", name); } |