[PATCH v3 09/10] can: peak_usb: unregister the netdev before dev_free() on probe failure

[Stéphane Grosjean]

From: Stéphane Grosjean <s.grosjean@xxxxxxxxxxxxxx>

When the device fails to switch the CAN bus off after the channel has
been initialized, peak_usb_create_dev() calls dev_free() before
unregister_candev(). For the first channel of PCAN-USB FD and Pro
adapters, dev_free() releases the interface object shared by all
channels, and also the command buffer on PCAN-USB FD.

The netdev is registered before the channel is initialized, so it may
have been opened in the meantime. unregister_candev() then closes it,
which accesses the released interface object and, on PCAN-USB FD,
sends commands through the released command buffer.

Unregister the netdev first, as peak_usb_disconnect() does.

Fixes: a0b96b4a6274 ("drivers: net: fix memory leak in peak_usb_create_dev")
Signed-off-by: Stéphane Grosjean <s.grosjean@xxxxxxxxxxxxxx>
---
 drivers/net/can/usb/peak_usb/pcan_usb_core.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_core.c b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
index 4c08656e7768..981168fead92 100644
--- a/drivers/net/can/usb/peak_usb/pcan_usb_core.c
+++ b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
@@ -1039,8 +1039,13 @@ static int peak_usb_create_dev(const struct peak_usb_adapter *peak_usb_adapter,
 	 */
 	peak_usb_stop_rx(dev->prev_siblings);
 
+	/* as in peak_usb_disconnect(), unregister the netdev before calling
+	 * dev_free(): closing it may still use what dev_free() releases.
+	 */
+	unregister_candev(netdev);
 	if (dev->adapter->dev_free)
 		dev->adapter->dev_free(dev);
+	goto lbl_restore_intf_data;
 
 lbl_unregister_candev:
 	unregister_candev(netdev);

-- 
2.53.0