lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

can: at91_can: fix use after free of priv

Browse Source 
The priv is part of the memory allocated by alloc_candev().
This patch moved the free it after last usage of priv.

While there convert all free_netdev() to free_candev() (which is currently
just a wrapper around free_netdev()) to be symetrically with the allocation
via alloc_candev().

Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Marc Kleine-Budde
2010-10-21 01:01:15 +00:00
committed by David S. Miller
parent 8a0e0a49b0
commit 759a6c768d
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
drivers/net/can/at91_can.c
View File

@@ -1101,7 +1101,7 @@ static int __init at91_can_probe(struct platform_device *pdev)
return 0; return 0;
exit_free: exit_free:
free_netdev(dev); free_candev(dev);
exit_iounmap: exit_iounmap:
iounmap(addr); iounmap(addr);
exit_release: exit_release:
@@ -1122,8 +1122,6 @@ static int __devexit at91_can_remove(struct platform_device *pdev)
platform_set_drvdata(pdev, NULL); platform_set_drvdata(pdev, NULL);
free_netdev(dev);
iounmap(priv->reg_base); iounmap(priv->reg_base);
res = platform_get_resource(pdev, IORESOURCE_MEM, 0); res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
@@ -1131,6 +1129,8 @@ static int __devexit at91_can_remove(struct platform_device *pdev)
clk_put(priv->clk); clk_put(priv->clk);
free_candev(dev);
return 0; return 0;
} }