Johan Hovold f38db8f14f ieee802154: atusb: fix use-after-free at disconnect ...

commit 7fd25e6fc0 upstream.

The disconnect callback was accessing the hardware-descriptor private
data after having having freed it.

Fixes: 7490b008d1 ("ieee802154: add support for atusb transceiver")
Cc: stable <stable@vger.kernel.org>     # 4.2
Cc: Alexander Aring <alex.aring@gmail.com>
Reported-by: syzbot+f4509a9138a1472e7e80@syzkaller.appspotmail.com
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2023-05-15 14:47:44 +09:00

..

appletalk

net/appletalk: fix minor pointer leak to userspace in SIOCFINDIPDDPRT

2023-05-15 08:25:07 +09:00

arcnet

arcnet: provide a buffer big enough to actually receive packets

2023-05-15 14:32:17 +09:00

bonding

bonding: Force slave speed check after link state recovery for 802.3ad

2023-05-15 14:20:28 +09:00

caif

caif-hsi: fix possible deadlock in cfhsi_exit_module()

2023-05-15 14:03:16 +09:00

can

can: mcp251x: mcp251x_hw_reset(): allow more time after a reset

2023-05-15 14:47:37 +09:00

cris

treewide: replace dev->trans_start update with helper

2016-05-04 14:16:49 -04:00

dsa

net: dsa: mv88e6xxx: wait after reset deactivation

2023-05-15 14:03:38 +09:00

ethernet

net: qlogic: Fix memory leak in ql_alloc_large_buffers

2023-05-15 14:41:27 +09:00

fddi

net: skfb: remove obsolete -I cflag

2016-06-15 22:06:06 -07:00

fjes

fjes: Fix wrong netdevice feature flags

2017-12-20 10:07:22 +01:00

hamradio

net: hamradio: use eth_broadcast_addr

2023-05-12 17:04:19 +09:00

hippi

hippi: Fix a Fix a possible sleep-in-atomic bug in rr_close

2018-02-25 11:05:50 +01:00

hyperv

hv_netvsc: Fix IP header checksum for coalesced packets

2023-05-15 11:49:53 +09:00

ieee802154

ieee802154: atusb: fix use-after-free at disconnect

2023-05-15 14:47:44 +09:00

ipvlan

ipvlan: disallow userns cap_net_admin to change global mode/flags

2023-05-15 11:55:28 +09:00

irda

irda: vlsi_ir: fix check for DMA mapping errors

2017-12-25 14:23:41 +01:00

phy

net/phy: fix DP83865 10 Mbps HDX loopback disable function

2023-05-15 14:32:22 +09:00

plip

…

ppp

ppp: Fix memory leak in ppp_write

2023-05-15 14:32:27 +09:00

slip

slip: make slhc_free() silently accept an error pointer

2023-05-15 12:35:39 +09:00

team

team: Add vlan tx offload to hw_enc_features

2023-05-15 14:20:19 +09:00

usb

qmi_wwan: add support for Cinterion CLS8 devices

2023-05-15 14:41:32 +09:00

vmxnet3

vmxnet3: use DMA memory barriers where required

2018-05-25 16:12:56 +02:00

wan

net/wan: fix a double free in x25_asy_open_tty()

2023-05-15 10:49:02 +09:00

wimax

wimax/i2400m: fix a memory leak bug

2023-05-15 14:28:27 +09:00

wireless

libertas: Add missing sentinel at end of if_usb.c fw_table

2023-05-15 14:34:10 +09:00

xen-netback

xen/netback: Reset nr_frags before freeing skb

2023-05-15 14:20:15 +09:00

dummy.c

…

eql.c

…

geneve.c

geneve: add missing rx stats accounting

2018-04-13 19:48:26 +02:00

gtp.c

gtp: fix use-after-free in gtp_newlink()

2023-05-15 14:01:41 +09:00

ifb.c

ifb: support more features

2016-05-09 00:00:28 -04:00

Kconfig

vmxnet3: prevent building with 64K pages

2018-02-25 11:05:51 +01:00

LICENSE.SRC

…

loopback.c

net: introduce device min_header_len

2017-02-18 15:11:43 +01:00

macsec.c

macsec: drop skb sk before calling gro_cells_receive

2023-05-15 14:32:20 +09:00

macvlan.c

macvlan: fix use-after-free in macvlan_common_newlink()

2018-05-30 07:50:30 +02:00

macvtap.c

tap: double-free in error path in tap_open()

2017-11-18 11:22:22 +01:00

Makefile

gtp: add initial driver for datapath of GPRS Tunneling Protocol (GTP-U)

2016-05-10 12:25:04 -04:00

mdio.c

…

mii.c

…

netconsole.c

…

nlmon.c

…

ntb_netdev.c

…

rionet.c

rapidio/rionet: do not free skb before reading its length

2023-05-15 10:05:03 +09:00

sb1000.c

…

Space.c

net: Fix coding style warnings and errors.

2016-05-19 11:48:27 -07:00

sungem_phy.c

…

tun.c

tun: fix use-after-free when register netdev failed

2023-05-15 14:29:39 +09:00

veth.c

veth: set peer GSO values

2018-03-22 09:17:57 +01:00

virtio_net.c

virtio-net: Fix operstate for virtio when no VIRTIO_NET_F_STATUS

2018-05-30 07:50:44 +02:00

vrf.c

vrf: make sure skb->data contains ip header to make routing

2023-05-15 14:04:23 +09:00

vxlan.c

vxlan: Don't call gro_cells_destroy() before device is unregistered

2023-05-15 12:12:11 +09:00

xen-netfront.c

xen-netfront: do not use ~0U as error return value for xennet_fill_frags()

2023-05-15 14:41:36 +09:00