p71924506
/
linux_old1
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

linux-can-fixes-for-4.9-20161208 

-----BEGIN PGP SIGNATURE-----
 
 iQFHBAABCgAxFiEES2FAuYbJvAGobdVQPTuqJaypJWoFAlhJeqETHG1rbEBwZW5n
 dXRyb25peC5kZQAKCRA9O6olrKklam/vB/wNjAgeQO6HUAQrC1558EMHbJyBPtCG
 yLJDyZcOQUmTBP0v9D0Fkg8LCjmEQaap9xGDoDVzhJp+qGVXkYu9IkLDDkulEkHN
 UbKu/qcjSjccmjxD2J65CXphfFQxIIOEuahPuXN6wiK3s8zjaJkrPS9jcdKkgmQ2
 3/NvLJtmgNJ6X8UhQ29aQtLvs635yQ7VxMj2LbYFIZ7BmtwDOBcFfk1crekKsfXW
 oNpNWn8VWjOfPdvYGjfqAewmGCHt2zUIYV/GNKEd8cg4jTkhZAvKqi+QE0+tkta8
 neNjn/hhi0nYOWz5iRLSYQMauVWzhMUlBrZ7R10926VKUWAzQGvBzZur
 =HP5G
 -----END PGP SIGNATURE-----

Merge tag 'linux-can-fixes-for-4.9-20161208' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can

Marc Kleine-Budde says:

====================
pull-request: can 2016-12-08

this is a pull request for one patch.

Jiho Chu found and fixed a use-after-free error in the cleanup path in
the peak pcan USB CAN driver.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
David S. Miller 2016-12-08 18:22:40 -05:00
parent d2a007ab19 b67d0dd7d0
commit 1e97426d29
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
drivers/net/can/usb/peak_usb/pcan_usb_core.c
View File

@ -870,23 +870,25 @@ static int peak_usb_create_dev(const struct peak_usb_adapter *peak_usb_adapter,
static void peak_usb_disconnect(struct usb_interface *intf)
{
struct peak_usb_device *dev;
struct peak_usb_device *dev_prev_siblings;
/* unregister as many netdev devices as siblings */
for (dev = usb_get_intfdata(intf); dev; dev = dev->prev_siblings) {
for (dev = usb_get_intfdata(intf); dev; dev = dev_prev_siblings) {
struct net_device *netdev = dev->netdev;
char name[IFNAMSIZ];
dev_prev_siblings = dev->prev_siblings;
dev->state &= ~PCAN_USB_STATE_CONNECTED;
strncpy(name, netdev->name, IFNAMSIZ);
unregister_netdev(netdev);
free_candev(netdev);
kfree(dev->cmd_buf);
dev->next_siblings = NULL;
if (dev->adapter->dev_free)
dev->adapter->dev_free(dev);
free_candev(netdev);
dev_info(&intf->dev, "%s removed\n", name);
}