| From 0b5a958cf4df3a5cd578b861471e62138f55c85e Mon Sep 17 00:00:00 2001 |
| From: Stephane Grosjean <s.grosjean@peak-system.com> |
| Date: Tue, 20 May 2014 11:38:56 +0200 |
| Subject: can: peak_pci: prevent use after free at netdev removal |
| |
| From: Stephane Grosjean <s.grosjean@peak-system.com> |
| |
| commit 0b5a958cf4df3a5cd578b861471e62138f55c85e upstream. |
| |
| As remarked by Christopher R. Baker in his post at |
| |
| http://marc.info/?l=linux-can&m=139707295706465&w=2 |
| |
| there's a possibility for an use after free condition at device removal. |
| |
| This simplified patch introduces an additional variable to prevent the issue. |
| Thanks for catching this. |
| |
| Reported-by: Christopher R. Baker <cbaker@rec.ri.cmu.edu> |
| Signed-off-by: Stephane Grosjean <s.grosjean@peak-system.com> |
| Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| drivers/net/can/sja1000/peak_pci.c | 14 +++++++++----- |
| 1 file changed, 9 insertions(+), 5 deletions(-) |
| |
| --- a/drivers/net/can/sja1000/peak_pci.c |
| +++ b/drivers/net/can/sja1000/peak_pci.c |
| @@ -551,7 +551,7 @@ static int peak_pci_probe(struct pci_dev |
| { |
| struct sja1000_priv *priv; |
| struct peak_pci_chan *chan; |
| - struct net_device *dev; |
| + struct net_device *dev, *prev_dev; |
| void __iomem *cfg_base, *reg_base; |
| u16 sub_sys_id, icr; |
| int i, err, channels; |
| @@ -687,11 +687,13 @@ failure_remove_channels: |
| writew(0x0, cfg_base + PITA_ICR + 2); |
| |
| chan = NULL; |
| - for (dev = pci_get_drvdata(pdev); dev; dev = chan->prev_dev) { |
| - unregister_sja1000dev(dev); |
| - free_sja1000dev(dev); |
| + for (dev = pci_get_drvdata(pdev); dev; dev = prev_dev) { |
| priv = netdev_priv(dev); |
| chan = priv->priv; |
| + prev_dev = chan->prev_dev; |
| + |
| + unregister_sja1000dev(dev); |
| + free_sja1000dev(dev); |
| } |
| |
| /* free any PCIeC resources too */ |
| @@ -725,10 +727,12 @@ static void peak_pci_remove(struct pci_d |
| |
| /* Loop over all registered devices */ |
| while (1) { |
| + struct net_device *prev_dev = chan->prev_dev; |
| + |
| dev_info(&pdev->dev, "removing device %s\n", dev->name); |
| unregister_sja1000dev(dev); |
| free_sja1000dev(dev); |
| - dev = chan->prev_dev; |
| + dev = prev_dev; |
| |
| if (!dev) { |
| /* do that only for first channel */ |