diff options
| author |   Jeremy Kerr <jk@codeconstruct.com.au> | 2022-02-11 09:15:52 +0800 |
|---|---|---|
| committer |   Jakub Kicinski <kuba@kernel.org> | 2022-02-11 14:39:54 -0800 |
| commit | 6c342ce2239c182c2428ce5a44cb32330434ae6e (patch) | |
| tree | ba24ff1aeea08f1731aab6139296938904c6386a /net/mac80211/rx.c | |
| parent | net: dsa: lan9303: fix reset on probe (diff) | |
| download | linux-dev-6c342ce2239c182c2428ce5a44cb32330434ae6e.tar.xz linux-dev-6c342ce2239c182c2428ce5a44cb32330434ae6e.zip | |
mctp: serial: Cancel pending work from ndo_uninit handler
We cannot do the cancel_work_sync from after the unregister_netdev, as
the dev pointer is no longer valid, causing a uaf on ldisc unregister
(or device close).
Instead, do the cancel_work_sync from the ndo_uninit op, where the dev
still exists, but the queue has stopped.
Fixes: 7bd9890f3d74 ("mctp: serial: cancel tx work on ldisc close")
Reported-by: Luo Likang <luolikang@nsfocus.com>
Tested-by: Luo Likang <luolikang@nsfocus.com>
Signed-off-by: Jeremy Kerr <jk@codeconstruct.com.au>
Link: https://lore.kernel.org/r/20220211011552.1861886-1-jk@codeconstruct.com.au
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'net/mac80211/rx.c')
0 files changed, 0 insertions, 0 deletions