Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d79f16c0 authored by David Miller's avatar David Miller Committed by David S. Miller
Browse files

mkiss: Fix use after free in mkiss_close(). 



Need to do the unregister_device() after all references to the driver
private have been done.

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent acf673a3

drivers/net/hamradio/mkiss.c

+2 −2
Original line number Diff line number Diff line
@@ -798,13 +798,13 @@ static void mkiss_close(struct tty_struct *tty) 
	if (!atomic_dec_and_test(&ax->refcnt))

		down(&ax->dead_sem);



	unregister_netdev(ax->dev);



	/* Free all AX25 frame buffers. */

	kfree(ax->rbuff);

	kfree(ax->xbuff);



	ax->tty = NULL;



	unregister_netdev(ax->dev);

}



/* Perform I/O control on an active ax25 channel. */