| From cf1391f2bd236ac3b6f0dfe61b0246bcab9ae68e Mon Sep 17 00:00:00 2001 |
| From: Johan Hovold <johan@kernel.org> |
| Date: Thu, 19 Sep 2019 14:12:34 +0200 |
| Subject: [PATCH] ieee802154: atusb: fix use-after-free at disconnect |
| |
| commit 7fd25e6fc035f4b04b75bca6d7e8daa069603a76 upstream. |
| |
| The disconnect callback was accessing the hardware-descriptor private |
| data after having having freed it. |
| |
| Fixes: 7490b008d123 ("ieee802154: add support for atusb transceiver") |
| Cc: stable <stable@vger.kernel.org> # 4.2 |
| Cc: Alexander Aring <alex.aring@gmail.com> |
| Reported-by: syzbot+f4509a9138a1472e7e80@syzkaller.appspotmail.com |
| Signed-off-by: Johan Hovold <johan@kernel.org> |
| Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org> |
| Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> |
| |
| diff --git a/drivers/net/ieee802154/atusb.c b/drivers/net/ieee802154/atusb.c |
| index ceddb424f887..0dd0ba915ab9 100644 |
| --- a/drivers/net/ieee802154/atusb.c |
| +++ b/drivers/net/ieee802154/atusb.c |
| @@ -1137,10 +1137,11 @@ static void atusb_disconnect(struct usb_interface *interface) |
| |
| ieee802154_unregister_hw(atusb->hw); |
| |
| + usb_put_dev(atusb->usb_dev); |
| + |
| ieee802154_free_hw(atusb->hw); |
| |
| usb_set_intfdata(interface, NULL); |
| - usb_put_dev(atusb->usb_dev); |
| |
| pr_debug("%s done\n", __func__); |
| } |
| -- |
| 2.7.4 |
| |
