Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b67d0dd7 authored by 추지호's avatar 추지호 Committed by Marc Kleine-Budde
Browse files

can: peak: fix bad memory access and free sequence 



Fix for bad memory access while disconnecting. netdev is freed before
private data free, and dev is accessed after freeing netdev.

This makes a slub problem, and it raise kernel oops with slub debugger
config.

Signed-off-by: default avatarJiho Chu <jiho.chu@samsung.com>
Cc: linux-stable <stable@vger.kernel.org>
Signed-off-by: default avatarMarc Kleine-Budde <mkl@pengutronix.de>
parent ec988ad7

drivers/net/can/usb/peak_usb/pcan_usb_core.c

+4 −2
Original line number Diff line number Diff line
@@ -870,23 +870,25 @@ static int peak_usb_create_dev(const struct peak_usb_adapter *peak_usb_adapter, 
static void peak_usb_disconnect(struct usb_interface *intf)

{

	struct peak_usb_device *dev;

	struct peak_usb_device *dev_prev_siblings;



	/* unregister as many netdev devices as siblings */

	for (dev = usb_get_intfdata(intf); dev; dev = dev->prev_siblings) {

	for (dev = usb_get_intfdata(intf); dev; dev = dev_prev_siblings) {

		struct net_device *netdev = dev->netdev;

		char name[IFNAMSIZ];



		dev_prev_siblings = dev->prev_siblings;

		dev->state &= ~PCAN_USB_STATE_CONNECTED;

		strncpy(name, netdev->name, IFNAMSIZ);



		unregister_netdev(netdev);

		free_candev(netdev);



		kfree(dev->cmd_buf);

		dev->next_siblings = NULL;

		if (dev->adapter->dev_free)

			dev->adapter->dev_free(dev);



		free_candev(netdev);

		dev_info(&intf->dev, "%s removed\n", name);

	}