forked from luck/tmp_suning_uos_patched
linux-can-fixes-for-3.15-20140521
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEABECAAYFAlN8ibsACgkQjTAFq1RaXHPXQQCdF6gWW/tCObrWO8cWHQJCRij+ FVwAn2cAfA0W8goptL45550Nhzd1ijQf =HF4f -----END PGP SIGNATURE----- Merge tag 'linux-can-fixes-for-3.15-20140521' of git://gitorious.org/linux-can/linux-can Marc Kleine-Budde says: ==================== pull-request: can 2014-05-21 this is a pull request for net/master, for the v3.15 release cycle, with a single patch. Christopher R. Baker found a use after free during unloading of the peak_pci driver. This is fixes in a patch by Stephane Grosjean. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
commit
a3431acf74
@ -551,7 +551,7 @@ static int peak_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
|
||||
{
|
||||
struct sja1000_priv *priv;
|
||||
struct peak_pci_chan *chan;
|
||||
struct net_device *dev;
|
||||
struct net_device *dev, *prev_dev;
|
||||
void __iomem *cfg_base, *reg_base;
|
||||
u16 sub_sys_id, icr;
|
||||
int i, err, channels;
|
||||
@ -688,11 +688,13 @@ static int peak_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
|
||||
writew(0x0, cfg_base + PITA_ICR + 2);
|
||||
|
||||
chan = NULL;
|
||||
for (dev = pci_get_drvdata(pdev); dev; dev = chan->prev_dev) {
|
||||
unregister_sja1000dev(dev);
|
||||
free_sja1000dev(dev);
|
||||
for (dev = pci_get_drvdata(pdev); dev; dev = prev_dev) {
|
||||
priv = netdev_priv(dev);
|
||||
chan = priv->priv;
|
||||
prev_dev = chan->prev_dev;
|
||||
|
||||
unregister_sja1000dev(dev);
|
||||
free_sja1000dev(dev);
|
||||
}
|
||||
|
||||
/* free any PCIeC resources too */
|
||||
@ -726,10 +728,12 @@ static void peak_pci_remove(struct pci_dev *pdev)
|
||||
|
||||
/* Loop over all registered devices */
|
||||
while (1) {
|
||||
struct net_device *prev_dev = chan->prev_dev;
|
||||
|
||||
dev_info(&pdev->dev, "removing device %s\n", dev->name);
|
||||
unregister_sja1000dev(dev);
|
||||
free_sja1000dev(dev);
|
||||
dev = chan->prev_dev;
|
||||
dev = prev_dev;
|
||||
|
||||
if (!dev) {
|
||||
/* do that only for first channel */
|
||||
|
Loading…
Reference in New Issue
Block a user