| From: Johan Hovold <johan@kernel.org> |
| Date: Tue, 1 Oct 2019 12:29:14 +0200 |
| Subject: can: usb_8dev: fix use-after-free on disconnect |
| |
| commit 3759739426186a924675651b388d1c3963c5710e upstream. |
| |
| The driver was accessing its driver data after having freed it. |
| |
| Fixes: 0024d8ad1639 ("can: usb_8dev: Add support for USB2CAN interface from 8 devices") |
| Cc: Bernd Krumboeck <b.krumboeck@gmail.com> |
| Cc: Wolfgang Grandegger <wg@grandegger.com> |
| Signed-off-by: Johan Hovold <johan@kernel.org> |
| Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de> |
| Signed-off-by: Ben Hutchings <ben@decadent.org.uk> |
| --- |
| drivers/net/can/usb/usb_8dev.c | 3 +-- |
| 1 file changed, 1 insertion(+), 2 deletions(-) |
| |
| --- a/drivers/net/can/usb/usb_8dev.c |
| +++ b/drivers/net/can/usb/usb_8dev.c |
| @@ -1013,9 +1013,8 @@ static void usb_8dev_disconnect(struct u |
| netdev_info(priv->netdev, "device disconnected\n"); |
| |
| unregister_netdev(priv->netdev); |
| - free_candev(priv->netdev); |
| - |
| unlink_all_urbs(priv); |
| + free_candev(priv->netdev); |
| } |
| |
| } |
