diff options
| author | David S. Miller <davem@davemloft.net> | 2014-05-22 15:39:44 -0400 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2014-05-22 15:39:44 -0400 |
| commit | a6cea535e0cb85ece0673ac10f9d81779225564f (patch) | |
| tree | 5ddccd8eba991d4de162a5bca2dfe5a1a81bdbaf | |
| parent | b1282726d53465c7362eb134eb335173e8cd5b8c (diff) | |
| parent | cf68f517c5c5041e3f3de502dccb008ec21f7262 (diff) | |
Merge tag 'linux-can-next-for-3.16-20140521' of git://gitorious.org/linux-can/linux-can-next
Marc Kleine-Budde says:
====================
pull-request: can-next 2014-05-19
this is a pull request of a single patch for net-next/master. It fixes a
use after free(), which slipped into to gs_usb driver.
====================
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | drivers/net/can/usb/gs_usb.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c index c9f1f99682b..04b0f84612f 100644 --- a/drivers/net/can/usb/gs_usb.c +++ b/drivers/net/can/usb/gs_usb.c @@ -826,8 +826,8 @@ static void gs_destroy_candev(struct gs_can *dev) { unregister_candev(dev->netdev); free_candev(dev->netdev); - kfree(dev); usb_kill_anchored_urbs(&dev->tx_submitted); + kfree(dev); } static int gs_usb_probe(struct usb_interface *intf, const struct usb_device_id *id) |