Messages in this thread Patch in this message | | | Date | Fri, 10 Mar 2023 14:58:52 +0100 | From | Simon Horman <> | Subject | Re: [PATCH net] xirc2ps_cs: Fix use after free bug in xirc2ps_detach |
| |
On Fri, Mar 10, 2023 at 12:57:29AM +0800, Zheng Wang wrote: > In xirc2ps_probe, the local->tx_timeout_task was bounded > with xirc2ps_tx_timeout_task. When timeout occurs, > it will call xirc_tx_timeout->schedule_work to start the > work. > > When we call xirc2ps_detach to remove the driver, there > may be a sequence as follows: > > Fix it by finishing the work before cleanup in xirc2ps_detach > > CPU0 CPU1 > > |xirc2ps_tx_timeout_task > xirc2ps_detach | > free_netdev | > kfree(dev); | > | > | do_reset > | //use > > Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") > Signed-off-by: Zheng Wang <zyytlz.wz@163.com> > --- > drivers/net/ethernet/xircom/xirc2ps_cs.c | 5 ++++- > 1 file changed, 4 insertions(+), 1 deletion(-) > > diff --git a/drivers/net/ethernet/xircom/xirc2ps_cs.c b/drivers/net/ethernet/xircom/xirc2ps_cs.c > index 894e92ef415b..ea7b06f75691 100644 > --- a/drivers/net/ethernet/xircom/xirc2ps_cs.c > +++ b/drivers/net/ethernet/xircom/xirc2ps_cs.c > @@ -503,7 +503,10 @@ static void > xirc2ps_detach(struct pcmcia_device *link) > { > struct net_device *dev = link->priv; > - > + struct local_info *local; > + > + local = netdev_priv(dev); > + cancel_work_sync(&local->tx_timeout_task) > dev_dbg(&link->dev, "detach\n"); > > unregister_netdev(dev);
This doesn't compile. Also, the indentation is incorrect.
I think what should have been posted is:
diff --git a/drivers/net/ethernet/xircom/xirc2ps_cs.c b/drivers/net/ethernet/xircom/xirc2ps_cs.c index 894e92ef415b..b607fea486ab 100644 --- a/drivers/net/ethernet/xircom/xirc2ps_cs.c +++ b/drivers/net/ethernet/xircom/xirc2ps_cs.c @@ -503,7 +503,10 @@ static void xirc2ps_detach(struct pcmcia_device *link) { struct net_device *dev = link->priv; + struct local_info *local; + local = netdev_priv(dev); + cancel_work_sync(&local->tx_timeout_task); dev_dbg(&link->dev, "detach\n"); unregister_netdev(dev);
| |