diff options
author | David Miller <davem@davemloft.net> | 2015-12-17 16:05:49 -0500 |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2015-12-18 16:03:03 -0500 |
commit | d79f16c046086f4fe0d42184a458e187464eb83e (patch) | |
tree | 0707cd45b01d5e7a910676b93babc584548d53f9 /drivers/net/hamradio/mkiss.c | |
parent | acf673a3187edf72068ee2f92f4dc47d66baed47 (diff) | |
download | op-kernel-dev-d79f16c046086f4fe0d42184a458e187464eb83e.zip op-kernel-dev-d79f16c046086f4fe0d42184a458e187464eb83e.tar.gz |
mkiss: Fix use after free in mkiss_close().
Need to do the unregister_device() after all references to the driver
private have been done.
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net/hamradio/mkiss.c')
-rw-r--r-- | drivers/net/hamradio/mkiss.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/net/hamradio/mkiss.c b/drivers/net/hamradio/mkiss.c index 216bfd3..0b72b9d 100644 --- a/drivers/net/hamradio/mkiss.c +++ b/drivers/net/hamradio/mkiss.c @@ -798,13 +798,13 @@ static void mkiss_close(struct tty_struct *tty) if (!atomic_dec_and_test(&ax->refcnt)) down(&ax->dead_sem); - unregister_netdev(ax->dev); - /* Free all AX25 frame buffers. */ kfree(ax->rbuff); kfree(ax->xbuff); ax->tty = NULL; + + unregister_netdev(ax->dev); } /* Perform I/O control on an active ax25 channel. */ |