From: David Miller Date: Thu, 17 Dec 2015 21:05:49 +0000 (-0500) Subject: mkiss: Fix use after free in mkiss_close(). X-Git-Tag: MMI-PSA29.97-13-9~8812^2~24 X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=d79f16c046086f4fe0d42184a458e187464eb83e;p=GitHub%2FMotorolaMobilityLLC%2Fkernel-slsi.git mkiss: Fix use after free in mkiss_close(). Need to do the unregister_device() after all references to the driver private have been done. Signed-off-by: David S. Miller --- diff --git a/drivers/net/hamradio/mkiss.c b/drivers/net/hamradio/mkiss.c index 216bfd350169..0b72b9de5207 100644 --- a/drivers/net/hamradio/mkiss.c +++ b/drivers/net/hamradio/mkiss.c @@ -798,13 +798,13 @@ static void mkiss_close(struct tty_struct *tty) if (!atomic_dec_and_test(&ax->refcnt)) down(&ax->dead_sem); - unregister_netdev(ax->dev); - /* Free all AX25 frame buffers. */ kfree(ax->rbuff); kfree(ax->xbuff); ax->tty = NULL; + + unregister_netdev(ax->dev); } /* Perform I/O control on an active ax25 channel. */