| From 0336f8ffece62f882ab3012820965a786a983f70 Mon Sep 17 00:00:00 2001 |
| From: Pavel Skripkin <paskripkin@gmail.com> |
| Date: Fri, 9 Jul 2021 17:58:29 +0300 |
| Subject: net: ti: fix UAF in tlan_remove_one |
| |
| From: Pavel Skripkin <paskripkin@gmail.com> |
| |
| commit 0336f8ffece62f882ab3012820965a786a983f70 upstream. |
| |
| priv is netdev private data and it cannot be |
| used after free_netdev() call. Using priv after free_netdev() |
| can cause UAF bug. Fix it by moving free_netdev() at the end of the |
| function. |
| |
| Fixes: 1e0a8b13d355 ("tlan: cancel work at remove path") |
| Signed-off-by: Pavel Skripkin <paskripkin@gmail.com> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| drivers/net/ethernet/ti/tlan.c | 3 +-- |
| 1 file changed, 1 insertion(+), 2 deletions(-) |
| |
| --- a/drivers/net/ethernet/ti/tlan.c |
| +++ b/drivers/net/ethernet/ti/tlan.c |
| @@ -312,9 +312,8 @@ static void tlan_remove_one(struct pci_d |
| pci_release_regions(pdev); |
| #endif |
| |
| - free_netdev(dev); |
| - |
| cancel_work_sync(&priv->tlan_tqueue); |
| + free_netdev(dev); |
| } |
| |
| static void tlan_start(struct net_device *dev) |