Messages in this thread | | | Date | Fri, 22 Feb 2019 15:35:10 -0800 (PST) | Subject | Re: [PATCH] mdio_bus: Fix use-after-free on device_register fails | From | David Miller <> |
| |
From: Yue Haibing <yuehaibing@huawei.com> Date: Thu, 21 Feb 2019 22:42:01 +0800
> From: YueHaibing <yuehaibing@huawei.com> > > KASAN has found use-after-free in fixed_mdio_bus_init, > commit 0c692d07842a ("drivers/net/phy/mdio_bus.c: call > put_device on device_register() failure") call put_device() > while device_register() fails,give up the last reference > to the device and allow mdiobus_release to be executed > ,kfreeing the bus. However in most drives, mdiobus_free > be called to free the bus while mdiobus_register fails. > use-after-free occurs when access bus again, this patch > revert it to let mdiobus_free free the bus. > > KASAN report details as below: ... > Fixes: 0c692d07842a ("drivers/net/phy/mdio_bus.c: call put_device on device_register() failure") > Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Applied and queued up for -stable, thanks.
| |