• Ben Hutchings's avatar
    slcan: Fix double-free on slcan_open() error path · f8535892
    Ben Hutchings authored
    Commit 9ebd796e ("can: slcan: Fix use-after-free Read in
    slcan_open") was incorrectly backported to 4.4 and 4.9 stable
    branches.
    
    Since they do not have commit cf124db5 ("net: Fix inconsistent
    teardown and release of private netdev state."), the destructor
    function slc_free_netdev() is already responsible for calling
    free_netdev() and slcan_open() must not call both of them.
    
    yangerkun previously fixed the same bug in slip.
    
    Fixes: ce624b2089ea ("can: slcan: Fix use-after-free Read in slcan_open") # 4.4
    Fixes: f59604a80fa4 ("slcan: not call free_netdev before rtnl_unlock ...") # 4.4
    Fixes: 56635a1e ("can: slcan: Fix use-after-free Read in slcan_open") # 4.9
    Fixes: a1c9b231 ("slcan: not call free_netdev before rtnl_unlock ...") # 4.9
    Cc: yangerkun <yangerkun@huawei.com>
    Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
    Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    f8535892
slcan.c 19.8 KB