| From e5d98c3955f998d0aac2e8d8cc6f094b9b517069 Mon Sep 17 00:00:00 2001 |
| From: Pan Bian <bianpan2016@163.com> |
| Date: Wed, 28 Nov 2018 15:30:24 +0800 |
| Subject: net: hisilicon: remove unexpected free_netdev |
| |
| [ Upstream commit c758940158bf29fe14e9d0f89d5848f227b48134 ] |
| |
| The net device ndev is freed via free_netdev when failing to register |
| the device. The control flow then jumps to the error handling code |
| block. ndev is used and freed again. Resulting in a use-after-free bug. |
| |
| Signed-off-by: Pan Bian <bianpan2016@163.com> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/net/ethernet/hisilicon/hip04_eth.c | 4 +--- |
| 1 file changed, 1 insertion(+), 3 deletions(-) |
| |
| diff --git a/drivers/net/ethernet/hisilicon/hip04_eth.c b/drivers/net/ethernet/hisilicon/hip04_eth.c |
| index 14374a856d30..6127697ede12 100644 |
| --- a/drivers/net/ethernet/hisilicon/hip04_eth.c |
| +++ b/drivers/net/ethernet/hisilicon/hip04_eth.c |
| @@ -914,10 +914,8 @@ static int hip04_mac_probe(struct platform_device *pdev) |
| } |
| |
| ret = register_netdev(ndev); |
| - if (ret) { |
| - free_netdev(ndev); |
| + if (ret) |
| goto alloc_fail; |
| - } |
| |
| return 0; |
| |
| -- |
| 2.19.1 |
| |
