* [PATCH 2/2] mkiss: Fix use after free in sixpack_close().
@ 2015-12-17 21:05 David Miller
2015-12-17 21:35 ` Ralf Baechle
0 siblings, 1 reply; 3+ messages in thread
From: David Miller @ 2015-12-17 21:05 UTC (permalink / raw)
To: gnomes
Cc: dvyukov, ajk, linux-hams, netdev, linux-kernel, gregkh, jslaby,
syzkaller, kcc, glider, sasha.levin, edumazet
Need to do the unregister_device() after all references to the driver
private have been done.
Signed-off-by: David S. Miller <davem@davemloft.net>
---
drivers/net/hamradio/mkiss.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/hamradio/mkiss.c b/drivers/net/hamradio/mkiss.c
index 216bfd3..0b72b9d 100644
--- a/drivers/net/hamradio/mkiss.c
+++ b/drivers/net/hamradio/mkiss.c
@@ -798,13 +798,13 @@ static void mkiss_close(struct tty_struct *tty)
if (!atomic_dec_and_test(&ax->refcnt))
down(&ax->dead_sem);
- unregister_netdev(ax->dev);
-
/* Free all AX25 frame buffers. */
kfree(ax->rbuff);
kfree(ax->xbuff);
ax->tty = NULL;
+
+ unregister_netdev(ax->dev);
}
/* Perform I/O control on an active ax25 channel. */
--
2.4.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH 2/2] mkiss: Fix use after free in sixpack_close().
2015-12-17 21:05 [PATCH 2/2] mkiss: Fix use after free in sixpack_close() David Miller
@ 2015-12-17 21:35 ` Ralf Baechle
2015-12-18 21:03 ` David Miller
0 siblings, 1 reply; 3+ messages in thread
From: Ralf Baechle @ 2015-12-17 21:35 UTC (permalink / raw)
To: David Miller
Cc: gnomes, dvyukov, ajk, linux-hams, netdev, linux-kernel, gregkh,
jslaby, syzkaller, kcc, glider, sasha.levin, edumazet
On Thu, Dec 17, 2015 at 04:05:49PM -0500, David Miller wrote:
> Subject: [PATCH 2/2] mkiss: Fix use after free in sixpack_close().
Make that subject "... mkiss_close()."
Ralf
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH 2/2] mkiss: Fix use after free in sixpack_close().
2015-12-17 21:35 ` Ralf Baechle
@ 2015-12-18 21:03 ` David Miller
0 siblings, 0 replies; 3+ messages in thread
From: David Miller @ 2015-12-18 21:03 UTC (permalink / raw)
To: ralf
Cc: gnomes, dvyukov, ajk, linux-hams, netdev, linux-kernel, gregkh,
jslaby, syzkaller, kcc, glider, sasha.levin, edumazet
From: Ralf Baechle <ralf@linux-mips.org>
Date: Thu, 17 Dec 2015 22:35:31 +0100
> On Thu, Dec 17, 2015 at 04:05:49PM -0500, David Miller wrote:
>
>> Subject: [PATCH 2/2] mkiss: Fix use after free in sixpack_close().
>
> Make that subject "... mkiss_close()."
Durrr... indeed. Thanks for catching that.
Committed as follows:
====================
[PATCH] mkiss: Fix use after free in mkiss_close().
Need to do the unregister_device() after all references to the driver
private have been done.
Signed-off-by: David S. Miller <davem@davemloft.net>
---
drivers/net/hamradio/mkiss.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/hamradio/mkiss.c b/drivers/net/hamradio/mkiss.c
index 216bfd3..0b72b9d 100644
--- a/drivers/net/hamradio/mkiss.c
+++ b/drivers/net/hamradio/mkiss.c
@@ -798,13 +798,13 @@ static void mkiss_close(struct tty_struct *tty)
if (!atomic_dec_and_test(&ax->refcnt))
down(&ax->dead_sem);
- unregister_netdev(ax->dev);
-
/* Free all AX25 frame buffers. */
kfree(ax->rbuff);
kfree(ax->xbuff);
ax->tty = NULL;
+
+ unregister_netdev(ax->dev);
}
/* Perform I/O control on an active ax25 channel. */
--
2.4.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
end of thread, other threads:[~2015-12-18 21:03 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2015-12-17 21:05 [PATCH 2/2] mkiss: Fix use after free in sixpack_close() David Miller
2015-12-17 21:35 ` Ralf Baechle
2015-12-18 21:03 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox