| Message ID | 81bc171fb2246201236c341e9b7d799f509d7dd4.1714660565.git.duoming@zju.edu.cn (mailing list archive) |
|---|---|
| State | Superseded |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | ax25: fix reference counting issue of ax25_dev | expand |
diff --git a/net/ax25/ax25_dev.c b/net/ax25/ax25_dev.c index 282ec581c07..07723095c60 100644 --- a/net/ax25/ax25_dev.c +++ b/net/ax25/ax25_dev.c @@ -208,7 +208,7 @@ void __exit ax25_dev_free(void) s = ax25_dev; netdev_put(ax25_dev->dev, &ax25_dev->dev_tracker); ax25_dev = ax25_dev->next; - kfree(s); + ax25_dev_put(s); } ax25_dev_list = NULL; spin_unlock_bh(&ax25_dev_lock);
The ax25_dev is managed by reference counting, so it should not be deallocated directly by kfree() in ax25_dev_free(), replace it with ax25_dev_put() instead. Fixes: d01ffb9eee4a ("ax25: add refcount in ax25_dev to avoid UAF bugs") Reported-by: Dan Carpenter <dan.carpenter@linaro.org> Signed-off-by: Duoming Zhou <duoming@zju.edu.cn> --- net/ax25/ax25_dev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)