[PATCH net] can: peak_pci: Fix potential use-after-free during removal

[Guangshuo Li]

The first channel uses the ExpressCard context in its write_reg
callback. Removal frees this context before unregister_sja1000dev()
writes the controller reset register.

Unregister the channel while its ExpressCard context and I2C adapter are
still available.

This issue was found by our static analysis tool under development.

Fixes: 949fe9b35570 ("can: peak_pci: peak_pci_remove(): fix UAF")
Signed-off-by: Guangshuo Li <liguangshuo@xxxxxxxxxxxxxxx>
---
 drivers/net/can/sja1000/peak_pci.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/can/sja1000/peak_pci.c b/drivers/net/can/sja1000/peak_pci.c
index 69c61ccf621d..618f8f6a5750 100644
--- a/drivers/net/can/sja1000/peak_pci.c
+++ b/drivers/net/can/sja1000/peak_pci.c
@@ -752,10 +752,10 @@ static void peak_pci_remove(struct pci_dev *pdev)
 		struct net_device *prev_dev = chan->prev_dev;
 
 		dev_info(&pdev->dev, "removing device %s\n", dev->name);
+		unregister_sja1000dev(dev);
 		/* do that only for first channel */
 		if (!prev_dev && chan->pciec_card)
 			peak_pciec_remove(chan->pciec_card);
-		unregister_sja1000dev(dev);
 		free_sja1000dev(dev);
 		dev = prev_dev;
 

base-commit: 2e54b3e187300893688c2c7517894f5d96732e05