Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1e97426d authored by David S. Miller's avatar David S. Miller
Browse files

Merge tag 'linux-can-fixes-for-4.9-20161208' of... 

Merge tag 'linux-can-fixes-for-4.9-20161208' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can



Marc Kleine-Budde says:

====================
pull-request: can 2016-12-08

this is a pull request for one patch.

Jiho Chu found and fixed a use-after-free error in the cleanup path in
the peak pcan USB CAN driver.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents d2a007ab b67d0dd7

drivers/net/can/usb/peak_usb/pcan_usb_core.c

+4 −2
Original line number Diff line number Diff line
@@ -870,23 +870,25 @@ static int peak_usb_create_dev(const struct peak_usb_adapter *peak_usb_adapter, 
static void peak_usb_disconnect(struct usb_interface *intf)

{

	struct peak_usb_device *dev;

	struct peak_usb_device *dev_prev_siblings;



	/* unregister as many netdev devices as siblings */

	for (dev = usb_get_intfdata(intf); dev; dev = dev->prev_siblings) {

	for (dev = usb_get_intfdata(intf); dev; dev = dev_prev_siblings) {

		struct net_device *netdev = dev->netdev;

		char name[IFNAMSIZ];



		dev_prev_siblings = dev->prev_siblings;

		dev->state &= ~PCAN_USB_STATE_CONNECTED;

		strncpy(name, netdev->name, IFNAMSIZ);



		unregister_netdev(netdev);

		free_candev(netdev);



		kfree(dev->cmd_buf);

		dev->next_siblings = NULL;

		if (dev->adapter->dev_free)

			dev->adapter->dev_free(dev);



		free_candev(netdev);

		dev_info(&intf->dev, "%s removed\n", name);

	}