| From 722f2b17b251a6b26f6f04054e858144f47c0a49 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Fri, 18 Jun 2021 17:57:31 +0300 |
| Subject: net: ethernet: aeroflex: fix UAF in greth_of_remove |
| |
| From: Pavel Skripkin <paskripkin@gmail.com> |
| |
| [ Upstream commit e3a5de6d81d8b2199935c7eb3f7d17a50a7075b7 ] |
| |
| static int greth_of_remove(struct platform_device *of_dev) |
| { |
| ... |
| struct greth_private *greth = netdev_priv(ndev); |
| ... |
| unregister_netdev(ndev); |
| free_netdev(ndev); |
| |
| of_iounmap(&of_dev->resource[0], greth->regs, resource_size(&of_dev->resource[0])); |
| ... |
| } |
| |
| greth is netdev private data, but it is used |
| after free_netdev(). It can cause use-after-free when accessing greth |
| pointer. So, fix it by moving free_netdev() after of_iounmap() |
| call. |
| |
| Fixes: d4c41139df6e ("net: Add Aeroflex Gaisler 10/100/1G Ethernet MAC driver") |
| Signed-off-by: Pavel Skripkin <paskripkin@gmail.com> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/net/ethernet/aeroflex/greth.c | 3 ++- |
| 1 file changed, 2 insertions(+), 1 deletion(-) |
| |
| diff --git a/drivers/net/ethernet/aeroflex/greth.c b/drivers/net/ethernet/aeroflex/greth.c |
| index 9c5891bbfe61..f4f50b3a472e 100644 |
| --- a/drivers/net/ethernet/aeroflex/greth.c |
| +++ b/drivers/net/ethernet/aeroflex/greth.c |
| @@ -1539,10 +1539,11 @@ static int greth_of_remove(struct platform_device *of_dev) |
| mdiobus_unregister(greth->mdio); |
| |
| unregister_netdev(ndev); |
| - free_netdev(ndev); |
| |
| of_iounmap(&of_dev->resource[0], greth->regs, resource_size(&of_dev->resource[0])); |
| |
| + free_netdev(ndev); |
| + |
| return 0; |
| } |
| |
| -- |
| 2.30.2 |
| |