diff options
| author | Clément Viel <clement.viel@qorvo.com> | 2022-11-17 14:43:52 +0000 |
|---|---|---|
| committer | Victor Liu <victorliu@google.com> | 2022-11-30 22:27:45 +0000 |
| commit | a601dd784ba2e9e8916577caf8aac885e7270190 (patch) | |
| tree | be4363b192d80888ea58ba6b7d80aa986d98b65b | |
| parent | dc2b974acc3ed5f3a6df879635e7c047735836d4 (diff) | |
| download | uwb-a601dd784ba2e9e8916577caf8aac885e7270190.tar.gz | |
dw3000: Fix UAF when removing dw3000 driver
bug: 244739021
Change-Id: I18a50a1816efdc4bf368e49a5e2bf7b1cef936de
Signed-off-by: Taha HAMDI <taha.hamdi@qorvo.com>
| -rw-r--r-- | kernel/drivers/net/ieee802154/dw3000_mcps.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/kernel/drivers/net/ieee802154/dw3000_mcps.c b/kernel/drivers/net/ieee802154/dw3000_mcps.c index 8c7c5c2..f1810a7 100644 --- a/kernel/drivers/net/ieee802154/dw3000_mcps.c +++ b/kernel/drivers/net/ieee802154/dw3000_mcps.c @@ -1488,8 +1488,9 @@ void dw3000_mcps_free(struct dw3000 *dw) { dev_dbg(dw->dev, "%s called\n", __func__); if (dw->llhw) { - mcps802154_free_llhw(dw->llhw); + struct mcps802154_llhw *llhw = dw->llhw; dw->llhw = NULL; + mcps802154_free_llhw(llhw); } } |