| From ab4a0b8fcb9a95c02909b62049811bd2e586aaa4 Mon Sep 17 00:00:00 2001 |
| From: Pavel Skripkin <paskripkin@gmail.com> |
| Date: Thu, 17 Jun 2021 21:51:30 +0300 |
| Subject: net: can: ems_usb: fix use-after-free in ems_usb_disconnect() |
| |
| From: Pavel Skripkin <paskripkin@gmail.com> |
| |
| commit ab4a0b8fcb9a95c02909b62049811bd2e586aaa4 upstream. |
| |
| In ems_usb_disconnect() dev pointer, which is netdev private data, is |
| used after free_candev() call: |
| | if (dev) { |
| | unregister_netdev(dev->netdev); |
| | free_candev(dev->netdev); |
| | |
| | unlink_all_urbs(dev); |
| | |
| | usb_free_urb(dev->intr_urb); |
| | |
| | kfree(dev->intr_in_buffer); |
| | kfree(dev->tx_msg_buffer); |
| | } |
| |
| Fix it by simply moving free_candev() at the end of the block. |
| |
| Fail log: |
| | BUG: KASAN: use-after-free in ems_usb_disconnect |
| | Read of size 8 at addr ffff88804e041008 by task kworker/1:2/2895 |
| | |
| | CPU: 1 PID: 2895 Comm: kworker/1:2 Not tainted 5.13.0-rc5+ #164 |
| | Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a-rebuilt.opensuse.4 |
| | Workqueue: usb_hub_wq hub_event |
| | Call Trace: |
| | dump_stack (lib/dump_stack.c:122) |
| | print_address_description.constprop.0.cold (mm/kasan/report.c:234) |
| | kasan_report.cold (mm/kasan/report.c:420 mm/kasan/report.c:436) |
| | ems_usb_disconnect (drivers/net/can/usb/ems_usb.c:683 drivers/net/can/usb/ems_usb.c:1058) |
| |
| Fixes: 702171adeed3 ("ems_usb: Added support for EMS CPC-USB/ARM7 CAN/USB interface") |
| Link: https://lore.kernel.org/r/20210617185130.5834-1-paskripkin@gmail.com |
| Cc: linux-stable <stable@vger.kernel.org> |
| Signed-off-by: Pavel Skripkin <paskripkin@gmail.com> |
| Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| drivers/net/can/usb/ems_usb.c | 3 ++- |
| 1 file changed, 2 insertions(+), 1 deletion(-) |
| |
| --- a/drivers/net/can/usb/ems_usb.c |
| +++ b/drivers/net/can/usb/ems_usb.c |
| @@ -1053,7 +1053,6 @@ static void ems_usb_disconnect(struct us |
| |
| if (dev) { |
| unregister_netdev(dev->netdev); |
| - free_candev(dev->netdev); |
| |
| unlink_all_urbs(dev); |
| |
| @@ -1061,6 +1060,8 @@ static void ems_usb_disconnect(struct us |
| |
| kfree(dev->intr_in_buffer); |
| kfree(dev->tx_msg_buffer); |
| + |
| + free_candev(dev->netdev); |
| } |
| } |
| |