public-mirrors/linux
1
0
Fork 0
mirror of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2025-11-01 09:13:37 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

linux-can-fixes-for-3.15-20140521

Browse source 
-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iEYEABECAAYFAlN8ibsACgkQjTAFq1RaXHPXQQCdF6gWW/tCObrWO8cWHQJCRij+
 FVwAn2cAfA0W8goptL45550Nhzd1ijQf
 =HF4f
 -----END PGP SIGNATURE-----

Merge tag 'linux-can-fixes-for-3.15-20140521' of git://gitorious.org/linux-can/linux-can

Marc Kleine-Budde says:

====================
pull-request: can 2014-05-21

this is a pull request for net/master, for the v3.15 release cycle, with a
single patch. Christopher R. Baker found a use after free during unloading of
the peak_pci driver. This is fixes in a patch by Stephane Grosjean.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
David S. Miller 2014-05-22 15:41:20 -04:00
commit a3431acf74
1 changed files with 9 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
drivers/net/can/sja1000/peak_pci.c
View file

@ -551,7 +551,7 @@ static int peak_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
{ {
struct sja1000_priv *priv; struct sja1000_priv *priv;
struct peak_pci_chan *chan; struct peak_pci_chan *chan;
struct net_device *dev; struct net_device *dev, *prev_dev;
void __iomem *cfg_base, *reg_base; void __iomem *cfg_base, *reg_base;
u16 sub_sys_id, icr; u16 sub_sys_id, icr;
int i, err, channels; int i, err, channels;
@ -688,11 +688,13 @@ failure_remove_channels:
writew(0x0, cfg_base + PITA_ICR + 2); writew(0x0, cfg_base + PITA_ICR + 2);
chan = NULL; chan = NULL;
for (dev = pci_get_drvdata(pdev); dev; dev = chan->prev_dev) { for (dev = pci_get_drvdata(pdev); dev; dev = prev_dev) {
unregister_sja1000dev(dev);
free_sja1000dev(dev);
priv = netdev_priv(dev); priv = netdev_priv(dev);
chan = priv->priv; chan = priv->priv;
prev_dev = chan->prev_dev;
unregister_sja1000dev(dev);
free_sja1000dev(dev);
} }
/* free any PCIeC resources too */ /* free any PCIeC resources too */
@ -726,10 +728,12 @@ static void peak_pci_remove(struct pci_dev *pdev)
/* Loop over all registered devices */ /* Loop over all registered devices */
while (1) { while (1) {
struct net_device *prev_dev = chan->prev_dev;
dev_info(&pdev->dev, "removing device %s\n", dev->name); dev_info(&pdev->dev, "removing device %s\n", dev->name);
unregister_sja1000dev(dev); unregister_sja1000dev(dev);
free_sja1000dev(dev); free_sja1000dev(dev);
dev = chan->prev_dev; dev = prev_dev;
if (!dev) { if (!dev) {
/* do that only for first channel */ /* do that only for first channel */