redonkable
/
alistair23-linux
1
0
Fork 0
Code Releases Activity

ieee802154: atusb: fix use-after-free at disconnect 

The disconnect callback was accessing the hardware-descriptor private
data after having having freed it.

Fixes: 7490b008d1 ("ieee802154: add support for atusb transceiver")
Cc: stable <stable@vger.kernel.org>     # 4.2
Cc: Alexander Aring <alex.aring@gmail.com>
Reported-by: syzbot+f4509a9138a1472e7e80@syzkaller.appspotmail.com
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
alistair/sunxi64-5.4-dsi
Johan Hovold 2019-09-19 14:12:34 +02:00 committed by Stefan Schmidt
parent f53a7ad189
commit 7fd25e6fc0
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
drivers/net/ieee802154/atusb.c
View File

@ -1137,10 +1137,11 @@ static void atusb_disconnect(struct usb_interface *interface)
ieee802154_unregister_hw(atusb->hw);
usb_put_dev(atusb->usb_dev);
ieee802154_free_hw(atusb->hw);
usb_set_intfdata(interface, NULL);
usb_put_dev(atusb->usb_dev);
pr_debug("%s done\n", __func__);
}