| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <20151217.160549.1465333502952441538.davem@davemloft.net> Date: Thu, 17 Dec 2015 16:05:49 -0500 (EST) From: David Miller <davem@...emloft.net> To: gnomes@...rguk.ukuu.org.uk Cc: dvyukov@...gle.com, ajk@...nets.uni-bremen.de, linux-hams@...r.kernel.org, netdev@...r.kernel.org, linux-kernel@...r.kernel.org, gregkh@...uxfoundation.org, jslaby@...e.com, syzkaller@...glegroups.com, kcc@...gle.com, glider@...gle.com, sasha.levin@...cle.com, edumazet@...gle.com Subject: [PATCH 2/2] mkiss: Fix use after free in sixpack_close(). Need to do the unregister_device() after all references to the driver private have been done. Signed-off-by: David S. Miller <davem@...emloft.net> --- drivers/net/hamradio/mkiss.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/hamradio/mkiss.c b/drivers/net/hamradio/mkiss.c index 216bfd3..0b72b9d 100644 --- a/drivers/net/hamradio/mkiss.c +++ b/drivers/net/hamradio/mkiss.c @@ -798,13 +798,13 @@ static void mkiss_close(struct tty_struct *tty) if (!atomic_dec_and_test(&ax->refcnt)) down(&ax->dead_sem); - unregister_netdev(ax->dev); - /* Free all AX25 frame buffers. */ kfree(ax->rbuff); kfree(ax->xbuff); ax->tty = NULL; + + unregister_netdev(ax->dev); } /* Perform I/O control on an active ax25 channel. */ -- 2.4.1 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists