| From c78eaeebe855fd93f2e77142ffd0404a54070d84 Mon Sep 17 00:00:00 2001 |
| From: Pavel Skripkin <paskripkin@gmail.com> |
| Date: Fri, 9 Jul 2021 17:09:53 +0300 |
| Subject: net: moxa: fix UAF in moxart_mac_probe |
| |
| From: Pavel Skripkin <paskripkin@gmail.com> |
| |
| commit c78eaeebe855fd93f2e77142ffd0404a54070d84 upstream. |
| |
| In case of netdev registration failure the code path will |
| jump to init_fail label: |
| |
| init_fail: |
| netdev_err(ndev, "init failed\n"); |
| moxart_mac_free_memory(ndev); |
| irq_map_fail: |
| free_netdev(ndev); |
| return ret; |
| |
| So, there is no need to call free_netdev() before jumping |
| to error handling path, since it can cause UAF or double-free |
| bug. |
| |
| Fixes: 6c821bd9edc9 ("net: Add MOXA ART SoCs ethernet driver") |
| Signed-off-by: Pavel Skripkin <paskripkin@gmail.com> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| drivers/net/ethernet/moxa/moxart_ether.c | 4 +--- |
| 1 file changed, 1 insertion(+), 3 deletions(-) |
| |
| --- a/drivers/net/ethernet/moxa/moxart_ether.c |
| +++ b/drivers/net/ethernet/moxa/moxart_ether.c |
| @@ -541,10 +541,8 @@ static int moxart_mac_probe(struct platf |
| SET_NETDEV_DEV(ndev, &pdev->dev); |
| |
| ret = register_netdev(ndev); |
| - if (ret) { |
| - free_netdev(ndev); |
| + if (ret) |
| goto init_fail; |
| - } |
| |
| netdev_dbg(ndev, "%s: IRQ=%d address=%pM\n", |
| __func__, ndev->irq, ndev->dev_addr); |