renegade-project/linux-next
2
0
Fork 0
mirror of https://github.com/edk2-porting/linux-next.git synced 2024-12-26 22:24:09 +08:00
Code

staging: slicoss: fix multiple free-after-free in slic_entry_remove

Browse Source 
This patch fixes two free-after-free bugs in slic_entry_remove.
Specifically, slic_unmap_mmio_space() iounmaps adapter->slic_regs,
which is the same region of memory as dev->base_addr (iounmap-ed
a few lines later).

Next, both release_mem_region() and pci_release_regions() are called
on the same pci_dev struct.

Signed-off-by: David Matlack <dmatlack@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
David Matlack 2014-05-05 21:02:32 -07:00 committed by Greg Kroah-Hartman
parent 65bc0aaa9c
commit a286e34de0
1 changed files with 0 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
drivers/staging/slicoss/slicoss.c
View File

@ -2954,8 +2954,6 @@ static void slic_card_cleanup(struct sliccard *card)
static void slic_entry_remove(struct pci_dev *pcidev)
{
struct net_device *dev = pci_get_drvdata(pcidev);
u32 mmio_start = 0;
uint mmio_len = 0;
struct adapter *adapter = netdev_priv(dev);
struct sliccard *card;
struct mcast_address *mcaddr, *mlist;
@ -2964,12 +2962,6 @@ static void slic_entry_remove(struct pci_dev *pcidev)
slic_unmap_mmio_space(adapter);
unregister_netdev(dev);
mmio_start = pci_resource_start(pcidev, 0);
mmio_len = pci_resource_len(pcidev, 0);
release_mem_region(mmio_start, mmio_len);
iounmap((void __iomem *)dev->base_addr);
/* free multicast addresses */
mlist = adapter->mcastaddrs;
while (mlist) {