lkml.org 
[lkml]   [2017]   [Jan]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.12 008/235] can: peak: fix bad memory access and free sequence
    Date
    From: 추지호 <jiho.chu@samsung.com>

    3.12-stable review patch. If anyone has any objections, please let me know.

    ===============

    commit b67d0dd7d0dc9e456825447bbeb935d8ef43ea7c upstream.

    Fix for bad memory access while disconnecting. netdev is freed before
    private data free, and dev is accessed after freeing netdev.

    This makes a slub problem, and it raise kernel oops with slub debugger
    config.

    Signed-off-by: Jiho Chu <jiho.chu@samsung.com>
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>
    ---
    drivers/net/can/usb/peak_usb/pcan_usb_core.c | 6 ++++--
    1 file changed, 4 insertions(+), 2 deletions(-)

    diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_core.c b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
    index 03e7f0cbda8c..47f0dcbf42ca 100644
    --- a/drivers/net/can/usb/peak_usb/pcan_usb_core.c
    +++ b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
    @@ -824,23 +824,25 @@ lbl_free_candev:
    static void peak_usb_disconnect(struct usb_interface *intf)
    {
    struct peak_usb_device *dev;
    + struct peak_usb_device *dev_prev_siblings;

    /* unregister as many netdev devices as siblings */
    - for (dev = usb_get_intfdata(intf); dev; dev = dev->prev_siblings) {
    + for (dev = usb_get_intfdata(intf); dev; dev = dev_prev_siblings) {
    struct net_device *netdev = dev->netdev;
    char name[IFNAMSIZ];

    + dev_prev_siblings = dev->prev_siblings;
    dev->state &= ~PCAN_USB_STATE_CONNECTED;
    strncpy(name, netdev->name, IFNAMSIZ);

    unregister_netdev(netdev);
    - free_candev(netdev);

    kfree(dev->cmd_buf);
    dev->next_siblings = NULL;
    if (dev->adapter->dev_free)
    dev->adapter->dev_free(dev);

    + free_candev(netdev);
    dev_info(&intf->dev, "%s removed\n", name);
    }

    --
    2.11.0
    \
     
     \ /
      Last update: 2017-01-27 13:04    [W:4.066 / U:0.264 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site