mirror of
https://github.com/torvalds/linux.git
synced 2025-11-10 05:30:50 +02:00
epic_close() calls epic_rx() and uses dma buffer, but in epic_remove_one()
we already freed the dma buffer. To fix this issue, reorder function calls
like in the .probe function.
BUG: KASAN: use-after-free in epic_rx+0xa6/0x7e0 [epic100]
Call Trace:
epic_rx+0xa6/0x7e0 [epic100]
epic_close+0xec/0x2f0 [epic100]
unregister_netdev+0x18/0x20
epic_remove_one+0xaa/0xf0 [epic100]
Fixes:
|
||
|---|---|---|
| .. | ||
| epic100.c | ||
| Kconfig | ||
| Makefile | ||
| smc91c92_cs.c | ||
| smc91x.c | ||
| smc91x.h | ||
| smc911x.c | ||
| smc911x.h | ||
| smc9194.c | ||
| smc9194.h | ||
| smsc911x.c | ||
| smsc911x.h | ||
| smsc9420.c | ||
| smsc9420.h | ||