lkml.org 
[lkml]   [2021]   [Jun]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.19 053/109] net: ethernet: fix potential use-after-free in ec_bhf_remove
    Date
    From: Pavel Skripkin <paskripkin@gmail.com>

    [ Upstream commit 9cca0c2d70149160407bda9a9446ce0c29b6e6c6 ]

    static void ec_bhf_remove(struct pci_dev *dev)
    {
    ...
    struct ec_bhf_priv *priv = netdev_priv(net_dev);

    unregister_netdev(net_dev);
    free_netdev(net_dev);

    pci_iounmap(dev, priv->dma_io);
    pci_iounmap(dev, priv->io);
    ...
    }

    priv is netdev private data, but it is used
    after free_netdev(). It can cause use-after-free when accessing priv
    pointer. So, fix it by moving free_netdev() after pci_iounmap()
    calls.

    Fixes: 6af55ff52b02 ("Driver for Beckhoff CX5020 EtherCAT master module.")
    Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/net/ethernet/ec_bhf.c | 4 +++-
    1 file changed, 3 insertions(+), 1 deletion(-)

    diff --git a/drivers/net/ethernet/ec_bhf.c b/drivers/net/ethernet/ec_bhf.c
    index d71cba0842c5..59dc20020c73 100644
    --- a/drivers/net/ethernet/ec_bhf.c
    +++ b/drivers/net/ethernet/ec_bhf.c
    @@ -585,10 +585,12 @@ static void ec_bhf_remove(struct pci_dev *dev)
    struct ec_bhf_priv *priv = netdev_priv(net_dev);

    unregister_netdev(net_dev);
    - free_netdev(net_dev);

    pci_iounmap(dev, priv->dma_io);
    pci_iounmap(dev, priv->io);
    +
    + free_netdev(net_dev);
    +
    pci_release_regions(dev);
    pci_clear_master(dev);
    pci_disable_device(dev);
    --
    2.30.2
    \
     
     \ /
      Last update: 2021-06-28 16:59    [W:4.765 / U:0.088 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site