lkml.org 
[lkml]   [2021]   [Aug]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.10 048/135] net: fec: fix use-after-free in fec_drv_remove
    Date
    From: Pavel Skripkin <paskripkin@gmail.com>

    [ Upstream commit 44712965bf12ae1758cec4de53816ed4b914ca1a ]

    Smatch says:
    drivers/net/ethernet/freescale/fec_main.c:3994 fec_drv_remove() error: Using fep after free_{netdev,candev}(ndev);
    drivers/net/ethernet/freescale/fec_main.c:3995 fec_drv_remove() error: Using fep after free_{netdev,candev}(ndev);

    Since fep pointer is netdev private data, accessing it after free_netdev()
    call can cause use-after-free bug. Fix it by moving free_netdev() call at
    the end of the function

    Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
    Fixes: a31eda65ba21 ("net: fec: fix clock count mis-match")
    Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
    Reviewed-by: Joakim Zhang <qiangqing.zhang@nxp.com>
    Reviewed-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/net/ethernet/freescale/fec_main.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
    index 2cb73e850a32..94eb838a0176 100644
    --- a/drivers/net/ethernet/freescale/fec_main.c
    +++ b/drivers/net/ethernet/freescale/fec_main.c
    @@ -3822,13 +3822,13 @@ fec_drv_remove(struct platform_device *pdev)
    if (of_phy_is_fixed_link(np))
    of_phy_deregister_fixed_link(np);
    of_node_put(fep->phy_node);
    - free_netdev(ndev);

    clk_disable_unprepare(fep->clk_ahb);
    clk_disable_unprepare(fep->clk_ipg);
    pm_runtime_put_noidle(&pdev->dev);
    pm_runtime_disable(&pdev->dev);

    + free_netdev(ndev);
    return 0;
    }

    --
    2.30.2


    \
     
     \ /
      Last update: 2021-08-10 20:13    [W:5.936 / U:0.012 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site