diff options
| author | David Miller <davem@davemloft.net> | 2015-12-17 16:05:49 -0500 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2015-12-18 16:03:03 -0500 |
| commit | d79f16c046086f4fe0d42184a458e187464eb83e (patch) | |
| tree | 0707cd45b01d5e7a910676b93babc584548d53f9 | |
| parent | acf673a3187edf72068ee2f92f4dc47d66baed47 (diff) | |
| download | linux-d79f16c046086f4fe0d42184a458e187464eb83e.tar.gz linux-d79f16c046086f4fe0d42184a458e187464eb83e.tar.bz2 linux-d79f16c046086f4fe0d42184a458e187464eb83e.zip | |
mkiss: Fix use after free in mkiss_close().
Need to do the unregister_device() after all references to the driver
private have been done.
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | drivers/net/hamradio/mkiss.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/net/hamradio/mkiss.c b/drivers/net/hamradio/mkiss.c index 216bfd350169..0b72b9de5207 100644 --- a/drivers/net/hamradio/mkiss.c +++ b/drivers/net/hamradio/mkiss.c @@ -798,13 +798,13 @@ static void mkiss_close(struct tty_struct *tty) if (!atomic_dec_and_test(&ax->refcnt)) down(&ax->dead_sem); - unregister_netdev(ax->dev); - /* Free all AX25 frame buffers. */ kfree(ax->rbuff); kfree(ax->xbuff); ax->tty = NULL; + + unregister_netdev(ax->dev); } /* Perform I/O control on an active ax25 channel. */ |