| From c702b6309e75599a16b3f756c842433b18204e05 Mon Sep 17 00:00:00 2001 |
| From: Johan Hovold <johan@kernel.org> |
| Date: Tue, 1 Oct 2019 12:29:14 +0200 |
| Subject: [PATCH] can: usb_8dev: fix use-after-free on disconnect |
| |
| commit 3759739426186a924675651b388d1c3963c5710e upstream. |
| |
| The driver was accessing its driver data after having freed it. |
| |
| Fixes: 0024d8ad1639 ("can: usb_8dev: Add support for USB2CAN interface from 8 devices") |
| Cc: stable <stable@vger.kernel.org> # 3.9 |
| Cc: Bernd Krumboeck <b.krumboeck@gmail.com> |
| Cc: Wolfgang Grandegger <wg@grandegger.com> |
| Signed-off-by: Johan Hovold <johan@kernel.org> |
| Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de> |
| Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> |
| |
| diff --git a/drivers/net/can/usb/usb_8dev.c b/drivers/net/can/usb/usb_8dev.c |
| index d596a2ad7f78..8fa224b28218 100644 |
| --- a/drivers/net/can/usb/usb_8dev.c |
| +++ b/drivers/net/can/usb/usb_8dev.c |
| @@ -996,9 +996,8 @@ static void usb_8dev_disconnect(struct usb_interface *intf) |
| netdev_info(priv->netdev, "device disconnected\n"); |
| |
| unregister_netdev(priv->netdev); |
| - free_candev(priv->netdev); |
| - |
| unlink_all_urbs(priv); |
| + free_candev(priv->netdev); |
| } |
| |
| } |
| -- |
| 2.7.4 |
| |
