Messages in this thread Patch in this message | | | From | Pavel Skripkin <> | Subject | [PATCH] net: ethernet: fix UAF in ltq_etop_init | Date | Sat, 26 Jun 2021 00:26:28 +0300 |
| |
In ltq_etop_init() netdev was used after free_netdev():
err_netdev: unregister_netdev(dev); free_netdev(dev); err_hw: ltq_etop_hw_exit(dev); return err;
It causes use-after-free read/write in ltq_etop_hw_exit(). Fix it by rewriting error handling path in this function. No logic changes, only small refactoring.
Fixes: ("MIPS: Lantiq: Add ethernet driver") Signed-off-by: Pavel Skripkin <paskripkin@gmail.com> --- drivers/net/ethernet/lantiq_etop.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/drivers/net/ethernet/lantiq_etop.c b/drivers/net/ethernet/lantiq_etop.c index 2d0c52f7106b..807a671ebcf8 100644 --- a/drivers/net/ethernet/lantiq_etop.c +++ b/drivers/net/ethernet/lantiq_etop.c @@ -553,8 +553,10 @@ ltq_etop_init(struct net_device *dev) dev->watchdog_timeo = 10 * HZ; err = ltq_etop_hw_init(dev); - if (err) - goto err_hw; + if (err) { + ltq_etop_hw_exit(dev); + return err; + } ltq_etop_change_mtu(dev, 1500); memcpy(&mac, &priv->pldata->mac, sizeof(struct sockaddr)); @@ -580,9 +582,8 @@ ltq_etop_init(struct net_device *dev) err_netdev: unregister_netdev(dev); - free_netdev(dev); -err_hw: ltq_etop_hw_exit(dev); + free_netdev(dev); return err; } -- 2.32.0
| |