lkml.org 
[lkml]   [2021]   [Jul]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.12 441/700] net: ethernet: aeroflex: fix UAF in greth_of_remove
    Date
    From: Pavel Skripkin <paskripkin@gmail.com>

    [ Upstream commit e3a5de6d81d8b2199935c7eb3f7d17a50a7075b7 ]

    static int greth_of_remove(struct platform_device *of_dev)
    {
    ...
    struct greth_private *greth = netdev_priv(ndev);
    ...
    unregister_netdev(ndev);
    free_netdev(ndev);

    of_iounmap(&of_dev->resource[0], greth->regs, resource_size(&of_dev->resource[0]));
    ...
    }

    greth is netdev private data, but it is used
    after free_netdev(). It can cause use-after-free when accessing greth
    pointer. So, fix it by moving free_netdev() after of_iounmap()
    call.

    Fixes: d4c41139df6e ("net: Add Aeroflex Gaisler 10/100/1G Ethernet MAC driver")
    Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/net/ethernet/aeroflex/greth.c | 3 ++-
    1 file changed, 2 insertions(+), 1 deletion(-)

    diff --git a/drivers/net/ethernet/aeroflex/greth.c b/drivers/net/ethernet/aeroflex/greth.c
    index 9c5891bbfe61..f4f50b3a472e 100644
    --- a/drivers/net/ethernet/aeroflex/greth.c
    +++ b/drivers/net/ethernet/aeroflex/greth.c
    @@ -1539,10 +1539,11 @@ static int greth_of_remove(struct platform_device *of_dev)
    mdiobus_unregister(greth->mdio);

    unregister_netdev(ndev);
    - free_netdev(ndev);

    of_iounmap(&of_dev->resource[0], greth->regs, resource_size(&of_dev->resource[0]));

    + free_netdev(ndev);
    +
    return 0;
    }

    --
    2.30.2


    \
     
     \ /
      Last update: 2021-07-12 09:51    [W:4.057 / U:0.040 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site