From: Tuba Yavuz <tuba@xxxxxxxxxxx> On an error path inside the hso_create_net_device function of the hso driver, hso_free_net_device gets called. This causes a use-after-free and a double-free if register_netdev has not been called yet as hso_free_net_device calls unregister_netdev regardless. I think the driver should distinguish these cases and call unregister_netdev only if register_netdev has been called. Signed-off-by: Tuba Yavuz <tuba@xxxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- v2: format cleaned up based on feedback from previous review Forward to Greg to submit due to email problems on Tuba's side diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c index 2bb28db89432..e6b56bdf691d 100644 --- a/drivers/net/usb/hso.c +++ b/drivers/net/usb/hso.c @@ -2366,7 +2366,8 @@ static void hso_free_net_device(struct hso_device *hso_dev, bool bailout) remove_net_device(hso_net->parent); - if (hso_net->net) + if (hso_net->net && + hso_net->net->reg_state == NETREG_REGISTERED) unregister_netdev(hso_net->net); /* start freeing */