mirror of
git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
synced 2025-05-22 09:13:05 +00:00
![]() epic_close() calls epic_rx() and uses dma buffer, but in epic_remove_one()
we already freed the dma buffer. To fix this issue, reorder function calls
like in the .probe function.
BUG: KASAN: use-after-free in epic_rx+0xa6/0x7e0 [epic100]
Call Trace:
epic_rx+0xa6/0x7e0 [epic100]
epic_close+0xec/0x2f0 [epic100]
unregister_netdev+0x18/0x20
epic_remove_one+0xaa/0xf0 [epic100]
Fixes:
|
||
---|---|---|
.. | ||
epic100.c | ||
Kconfig | ||
Makefile | ||
smc91c92_cs.c | ||
smc91x.c | ||
smc91x.h | ||
smc911x.c | ||
smc911x.h | ||
smc9194.c | ||
smc9194.h | ||
smsc911x.c | ||
smsc911x.h | ||
smsc9420.c | ||
smsc9420.h |