renegade-project/linux-next
2
0
Fork 0
mirror of https://github.com/edk2-porting/linux-next.git synced 2024-12-20 03:04:01 +08:00
Code

mkiss: Fix use after free in mkiss_close().

Browse Source 
Need to do the unregister_device() after all references to the driver
private have been done.

Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
David Miller 2015-12-17 16:05:49 -05:00 committed by David S. Miller
parent acf673a318
commit d79f16c046
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/net/hamradio/mkiss.c
View File

@ -798,13 +798,13 @@ static void mkiss_close(struct tty_struct *tty)
if (!atomic_dec_and_test(&ax->refcnt))
down(&ax->dead_sem);
unregister_netdev(ax->dev);
/* Free all AX25 frame buffers. */
kfree(ax->rbuff);
kfree(ax->xbuff);
ax->tty = NULL;
unregister_netdev(ax->dev);
}
/* Perform I/O control on an active ax25 channel. */