Commit d79f16c0 authored by David Miller's avatar David Miller Committed by David S. Miller

mkiss: Fix use after free in mkiss_close().

Need to do the unregister_device() after all references to the driver
private have been done.
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent acf673a3
...@@ -798,13 +798,13 @@ static void mkiss_close(struct tty_struct *tty) ...@@ -798,13 +798,13 @@ static void mkiss_close(struct tty_struct *tty)
if (!atomic_dec_and_test(&ax->refcnt)) if (!atomic_dec_and_test(&ax->refcnt))
down(&ax->dead_sem); down(&ax->dead_sem);
unregister_netdev(ax->dev);
/* Free all AX25 frame buffers. */ /* Free all AX25 frame buffers. */
kfree(ax->rbuff); kfree(ax->rbuff);
kfree(ax->xbuff); kfree(ax->xbuff);
ax->tty = NULL; ax->tty = NULL;
unregister_netdev(ax->dev);
} }
/* Perform I/O control on an active ax25 channel. */ /* Perform I/O control on an active ax25 channel. */
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment