Messages in this thread | | | Date | Mon, 20 Jun 2022 10:40:16 -0400 | From | Jon Mason <> | Subject | Re: [PATCH] [PATCH net v2]vexy: Fix a use-after-free bug in vxge-main.c |
| |
On Wed, Jun 15, 2022 at 07:50:50PM -0700, Jakub Kicinski wrote: > Jon, if you're there, do you have any sense on whether this HW is still > in production somewhere? I scrolled thru last 5 years of the git history > and there doesn't seem to be any meaningful change here while there's a > significant volume of refactoring going in.
Neterion was killed off by Exar after acquiring it roughly a decade ago. To my knowledge no one ever acquired the IP. So, this should be viewed as an EOL'ed part. It is a mature driver and I believe there are parts out in the field still. So, no need to kill off the driver.
Thanks, Jon
> > > On the patch itself: > > On Wed, 15 Jun 2022 09:38:16 +0800 Wentao_Liang wrote: > > Subject: [PATCH] [PATCH net v2]vexy: Fix a use-after-free bug in vxge-main.c > > No need to repeat "[PATCH]" > The driver is not called "vexy" as far as I can tell. > > > The pointer vdev points to a memory region adjacent to a net_device > > structure ndev, which is a field of hldev. At line 4740, the invocation > > to vxge_device_unregister unregisters device hldev, and it also releases > > the memory region pointed by vdev->bar0. At line 4743, the freed memory > > region is referenced (i.e., iounmap(vdev->bar0)), resulting in a > > use-after-free vulnerability. We can fix the bug by calling iounmap > > before vxge_device_unregister. > > Are you sure the bar0 is not needed by the netdev? You're freeing > memory that the netdev may need until it's unregistered.
| |