]> git.baikalelectronics.ru Git - kernel.git/commit
net: usb: fix possible use-after-free in smsc75xx_bind
authorDongliang Mu <mudongliangabcd@gmail.com>
Wed, 16 Jun 2021 02:48:33 +0000 (10:48 +0800)
committerDavid S. Miller <davem@davemloft.net>
Wed, 16 Jun 2021 19:36:09 +0000 (12:36 -0700)
commit6b1c619a6894a407a0687ad6f1342c4085848298
treeba4eb051ad18da32e4c64d64cdfd430c765a7a87
parent5832a2fb8e8671679945c50f11de200ac3f517c8
net: usb: fix possible use-after-free in smsc75xx_bind

The commit 4e1174e02b17 ("net: usb: fix memory leak in smsc75xx_bind")
fails to clean up the work scheduled in smsc75xx_reset->
smsc75xx_set_multicast, which leads to use-after-free if the work is
scheduled to start after the deallocation. In addition, this patch
also removes a dangling pointer - dev->data[0].

This patch calls cancel_work_sync to cancel the scheduled work and set
the dangling pointer to NULL.

Fixes: 4e1174e02b17 ("net: usb: fix memory leak in smsc75xx_bind")
Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
drivers/net/usb/smsc75xx.c