| From 7fd25e6fc035f4b04b75bca6d7e8daa069603a76 Mon Sep 17 00:00:00 2001 |
| From: Johan Hovold <johan@kernel.org> |
| Date: Thu, 19 Sep 2019 14:12:34 +0200 |
| Subject: ieee802154: atusb: fix use-after-free at disconnect |
| |
| From: Johan Hovold <johan@kernel.org> |
| |
| commit 7fd25e6fc035f4b04b75bca6d7e8daa069603a76 upstream. |
| |
| The disconnect callback was accessing the hardware-descriptor private |
| data after having having freed it. |
| |
| Fixes: 7490b008d123 ("ieee802154: add support for atusb transceiver") |
| Cc: stable <stable@vger.kernel.org> # 4.2 |
| Cc: Alexander Aring <alex.aring@gmail.com> |
| Reported-by: syzbot+f4509a9138a1472e7e80@syzkaller.appspotmail.com |
| Signed-off-by: Johan Hovold <johan@kernel.org> |
| Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| drivers/net/ieee802154/atusb.c | 3 ++- |
| 1 file changed, 2 insertions(+), 1 deletion(-) |
| |
| --- a/drivers/net/ieee802154/atusb.c |
| +++ b/drivers/net/ieee802154/atusb.c |
| @@ -756,10 +756,11 @@ static void atusb_disconnect(struct usb_ |
| |
| ieee802154_unregister_hw(atusb->hw); |
| |
| + usb_put_dev(atusb->usb_dev); |
| + |
| ieee802154_free_hw(atusb->hw); |
| |
| usb_set_intfdata(interface, NULL); |
| - usb_put_dev(atusb->usb_dev); |
| |
| pr_debug("atusb_disconnect done\n"); |
| } |
