diff options
| author | David Miller <davem@davemloft.net> | 2015-12-18 00:05:32 +0300 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2015-12-18 23:57:33 +0300 |
| commit | acf673a3187edf72068ee2f92f4dc47d66baed47 (patch) | |
| tree | e85436a3323c793d89ab76e0b1c96e8841fa9776 /drivers/net/hamradio/6pack.c | |
| parent | 6e3cd5fa65318f35ec9c9f61bc5cdb55d4783cb9 (diff) | |
| download | linux-acf673a3187edf72068ee2f92f4dc47d66baed47.tar.xz | |
6pack: Fix use after free in sixpack_close().
Need to do the unregister_device() after all references to the driver
private have been done.
Also we need to use del_timer_sync() for the timers so that we don't
have any asynchronous references after the unregister.
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net/hamradio/6pack.c')
| -rw-r--r-- | drivers/net/hamradio/6pack.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c index 7c4a4151ef0f..9f0b1c342b77 100644 --- a/drivers/net/hamradio/6pack.c +++ b/drivers/net/hamradio/6pack.c @@ -683,14 +683,14 @@ static void sixpack_close(struct tty_struct *tty) if (!atomic_dec_and_test(&sp->refcnt)) down(&sp->dead_sem); - unregister_netdev(sp->dev); - - del_timer(&sp->tx_t); - del_timer(&sp->resync_t); + del_timer_sync(&sp->tx_t); + del_timer_sync(&sp->resync_t); /* Free all 6pack frame buffers. */ kfree(sp->rbuff); kfree(sp->xbuff); + + unregister_netdev(sp->dev); } /* Perform I/O control on an active 6pack channel. */ |