From: Dan Carpenter <dan.carpenter@oracle.com>
To: Wolfgang Grandegger <wg@grandegger.com>,
Oliver Hartkopp <socketcan@hartkopp.net>
Cc: Marc Kleine-Budde <mkl@pengutronix.de>,
"David S. Miller" <davem@davemloft.net>,
Jakub Kicinski <kuba@kernel.org>,
Leon Romanovsky <leon@kernel.org>,
Markus Plessing <plessing@ems-wuensche.com>,
linux-can@vger.kernel.org, netdev@vger.kernel.org,
kernel-janitors@vger.kernel.org
Subject: [PATCH v2 net] can: sja1000: fix use after free in ems_pcmcia_add_card()
Date: Wed, 24 Nov 2021 09:56:18 +0300 [thread overview]
Message-ID: <20211124065618.GA3970@kili> (raw)
If the last channel is not available then "dev" is freed. Fortunately,
we can just use "pdev->irq" instead.
Fixes: fd734c6f25ae ("can/sja1000: add driver for EMS PCMCIA card")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
v2: In the first version, I just failed the probe. Sorry about that.
drivers/net/can/sja1000/ems_pcmcia.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/can/sja1000/ems_pcmcia.c b/drivers/net/can/sja1000/ems_pcmcia.c
index e21b169c14c0..391a8253ed6f 100644
--- a/drivers/net/can/sja1000/ems_pcmcia.c
+++ b/drivers/net/can/sja1000/ems_pcmcia.c
@@ -234,7 +234,7 @@ static int ems_pcmcia_add_card(struct pcmcia_device *pdev, unsigned long base)
free_sja1000dev(dev);
}
- err = request_irq(dev->irq, &ems_pcmcia_interrupt, IRQF_SHARED,
+ err = request_irq(pdev->irq, &ems_pcmcia_interrupt, IRQF_SHARED,
DRV_NAME, card);
if (!err)
return 0;
--
2.20.1
next reply other threads:[~2021-11-24 6:57 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-11-24 6:56 Dan Carpenter [this message]
2021-11-24 7:37 ` [PATCH v2 net] can: sja1000: fix use after free in ems_pcmcia_add_card() Oliver Hartkopp
2021-11-24 8:57 ` Dan Carpenter
2021-11-24 9:13 ` Oliver Hartkopp
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20211124065618.GA3970@kili \
--to=dan.carpenter@oracle.com \
--cc=davem@davemloft.net \
--cc=kernel-janitors@vger.kernel.org \
--cc=kuba@kernel.org \
--cc=leon@kernel.org \
--cc=linux-can@vger.kernel.org \
--cc=mkl@pengutronix.de \
--cc=netdev@vger.kernel.org \
--cc=plessing@ems-wuensche.com \
--cc=socketcan@hartkopp.net \
--cc=wg@grandegger.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.