Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

can: mcba_usb: fix use-after-free on disconnect

The driver was accessing its driver data after having freed it.

Fixes: 51f3baad7de9 ("can: mcba_usb: Add support for Microchip CAN BUS Analyzer")
Cc: stable <stable@vger.kernel.org> # 4.12
Cc: Remigiusz Kołłątaj <remigiusz.kollataj@mobica.com>
Reported-by: syzbot+e29b17e5042bbc56fae9@syzkaller.appspotmail.com
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>

authored by

Johan Hovold and committed by
Marc Kleine-Budde
4d663649 fb5be6a7

+1 -2
+1 -2
drivers/net/can/usb/mcba_usb.c
··· 876 876 netdev_info(priv->netdev, "device disconnected\n"); 877 877 878 878 unregister_candev(priv->netdev); 879 - free_candev(priv->netdev); 880 - 881 879 mcba_urb_unlink(priv); 880 + free_candev(priv->netdev); 882 881 } 883 882 884 883 static struct usb_driver mcba_usb_driver = {