Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit acf673a3 authored by David Miller's avatar David Miller Committed by David S. Miller
Browse files

6pack: Fix use after free in sixpack_close(). 



Need to do the unregister_device() after all references to the driver
private have been done.

Also we need to use del_timer_sync() for the timers so that we don't
have any asynchronous references after the unregister.

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 6e3cd5fa

drivers/net/hamradio/6pack.c

+4 −4
Original line number Diff line number Diff line
@@ -683,14 +683,14 @@ static void sixpack_close(struct tty_struct *tty) 
	if (!atomic_dec_and_test(&sp->refcnt))

		down(&sp->dead_sem);



	unregister_netdev(sp->dev);



	del_timer(&sp->tx_t);

	del_timer(&sp->resync_t);

	del_timer_sync(&sp->tx_t);

	del_timer_sync(&sp->resync_t);



	/* Free all 6pack frame buffers. */

	kfree(sp->rbuff);

	kfree(sp->xbuff);



	unregister_netdev(sp->dev);

}



/* Perform I/O control on an active 6pack channel. */