slcan: Fix double-free on slcan_open() error path
authorBen Hutchings <ben@decadent.org.uk>
Tue, 2 Jun 2020 17:54:18 +0000 (18:54 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 11 Jun 2020 07:22:20 +0000 (09:22 +0200)
commitf8535892e13ea72d3a1dedc7f171854fc765fcc9
tree1dd5ad380437d33c60bd4e69ff19d9e8a4aa8c04
parenta7481f5f1abeb1e5ed51b2f755eb75f2aa7f4741
slcan: Fix double-free on slcan_open() error path

Commit 9ebd796e2400 ("can: slcan: Fix use-after-free Read in
slcan_open") was incorrectly backported to 4.4 and 4.9 stable
branches.

Since they do not have commit cf124db566e6 ("net: Fix inconsistent
teardown and release of private netdev state."), the destructor
function slc_free_netdev() is already responsible for calling
free_netdev() and slcan_open() must not call both of them.

yangerkun previously fixed the same bug in slip.

Fixes: ce624b2089ea ("can: slcan: Fix use-after-free Read in slcan_open") # 4.4
Fixes: f59604a80fa4 ("slcan: not call free_netdev before rtnl_unlock ...") # 4.4
Fixes: 56635a1e6ffb ("can: slcan: Fix use-after-free Read in slcan_open") # 4.9
Fixes: a1c9b23142ac ("slcan: not call free_netdev before rtnl_unlock ...") # 4.9
Cc: yangerkun <yangerkun@huawei.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/net/can/slcan.c