diff options
| author | Ben Hutchings <ben@decadent.org.uk> | 2020-06-02 18:54:18 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2020-06-11 09:21:38 +0200 |
| commit | ab3ec512a1bd9a8269dc8292aff9bb12ce83ba83 (patch) | |
| tree | 90790e2ac1c2061c9b741d96ab312a74d0c469d1 /drivers/net | |
| parent | 6997070078c2e072bb8ab7628767087ab72528c4 (diff) | |
slcan: Fix double-free on slcan_open() error path
Commit 9ebd796e2400 ("can: slcan: Fix use-after-free Read in
slcan_open") was incorrectly backported to 4.4 and 4.9 stable
branches.
Since they do not have commit cf124db566e6 ("net: Fix inconsistent
teardown and release of private netdev state."), the destructor
function slc_free_netdev() is already responsible for calling
free_netdev() and slcan_open() must not call both of them.
yangerkun previously fixed the same bug in slip.
Fixes: ce624b2089ea ("can: slcan: Fix use-after-free Read in slcan_open") # 4.4
Fixes: f59604a80fa4 ("slcan: not call free_netdev before rtnl_unlock ...") # 4.4
Fixes: 56635a1e6ffb ("can: slcan: Fix use-after-free Read in slcan_open") # 4.9
Fixes: a1c9b23142ac ("slcan: not call free_netdev before rtnl_unlock ...") # 4.9
Cc: yangerkun <yangerkun@huawei.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/net')
| -rw-r--r-- | drivers/net/can/slcan.c | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/drivers/net/can/slcan.c b/drivers/net/can/slcan.c index 5bacb019ec1f..1107f200d3f1 100644 --- a/drivers/net/can/slcan.c +++ b/drivers/net/can/slcan.c @@ -618,10 +618,9 @@ err_free_chan: sl->tty = NULL; tty->disc_data = NULL; clear_bit(SLF_INUSE, &sl->flags); - slc_free_netdev(sl->dev); /* do not call free_netdev before rtnl_unlock */ rtnl_unlock(); - free_netdev(sl->dev); + slc_free_netdev(sl->dev); return err; err_exit: |