Received: by 2002:a05:6a10:c604:0:0:0:0 with SMTP id y4csp3755920pxt; Tue, 10 Aug 2021 10:34:16 -0700 (PDT) X-Google-Smtp-Source: ABdhPJyY2bQv9kAKZHSmsz77q7iv4sr3w3gjBuomRbw+NOekGqV0kvdjwzdCh9AsjfzyafYY+Ze5 X-Received: by 2002:a17:906:eb88:: with SMTP id mh8mr103220ejb.246.1628616856385; Tue, 10 Aug 2021 10:34:16 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1628616856; cv=none; d=google.com; s=arc-20160816; b=0unQlqgUnzohUa4iObCSyq9v8UIv7yVLgJkCqFae4HpxjT2e9kVtyjmlXW60JBzGo1 WnU9lSTfr8ZPhyO0LnBQl1x1Uy81gqBZBv4xYoJgFf6BDwIZAgAEwLsik3/M7rpiaWcT +yX5X7t7m4Ek2PuWUH2FLyY+RB6ajbJ1ct4ViWBhiQ+jBmvo4UXDVyKmBwhO2obKDd/e pjcc51eQMxzyZd/qwXBT6egZFQAqEXm6kRxJan4EstqyKTeBzXy3zqHJ6uBf6itJ/t77 zRHSmmzkQj3M68+JQGfPXDeYNXaf9z7Tw503mCGm4tTnYW3OLhzQeWD/nAynG6xfJnNm L5Bw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=uH8SfAQWMBYMs1dgwmGDdP73sdUBx12v/1QwiZ5CzMo=; b=vvvstWCM88ciL0uMzUuZjpJOUwZeTePIhepn3oHMCsJAfGNTFspu6FfMl5ICk88kDD 9DgWgkrjuHFBCZGswFxc76o6yKbOTbX4u+PUUwxelDxqVG7yjhqhK0z5SHYbVPbiguKS VEUdzZEB7hXQMzX2QzG4HDslJFQ73mbQMbAiSmK1v/DbSZUAHKXPfTYjqTtLPoblRWPS 35wMIQYWXYhGWWao4gGFmTuKUFc7BO40A9HcwrXI4vFkgucjxwVdLZ6QZ5vsD/mM7TX7 +k/foy/lh2eIiz2re3aWPObz4Y+/hqq939AZV/pfquNSyweB739gdo7w+ut0BSXgd0sp m6iw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=Qn7A7vQB; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id aq20si679144ejc.97.2021.08.10.10.33.52; Tue, 10 Aug 2021 10:34:16 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=Qn7A7vQB; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231233AbhHJRc1 (ORCPT + 99 others); Tue, 10 Aug 2021 13:32:27 -0400 Received: from mail.kernel.org ([198.145.29.99]:60120 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230394AbhHJRcV (ORCPT ); Tue, 10 Aug 2021 13:32:21 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 5557860EBD; Tue, 10 Aug 2021 17:31:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1628616718; bh=GLX5gd/pFzbGIR57O/FMwZtECm11RR0gCt2whte+wn4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Qn7A7vQBUxxLjQGlsc3NC5hZTA05x7QEoO7M8i1f1tcJNZRP+XGg/W0vTh5168jXp pnf1jnoBEEBIhVmW757lF18V8Vr8vKZlqjeVelNEp55Blfr+Tmc1RCtUO6AQH+Z5WQ BR5xIEl3VWT9P++CsJovsNPFiQtce62R2ktYMew4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dan Carpenter , Pavel Skripkin , Joakim Zhang , Jesse Brandeburg , Jakub Kicinski , Sasha Levin Subject: [PATCH 4.19 17/54] net: fec: fix use-after-free in fec_drv_remove Date: Tue, 10 Aug 2021 19:30:11 +0200 Message-Id: <20210810172944.748596529@linuxfoundation.org> X-Mailer: git-send-email 2.32.0 In-Reply-To: <20210810172944.179901509@linuxfoundation.org> References: <20210810172944.179901509@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Pavel Skripkin [ Upstream commit 44712965bf12ae1758cec4de53816ed4b914ca1a ] Smatch says: drivers/net/ethernet/freescale/fec_main.c:3994 fec_drv_remove() error: Using fep after free_{netdev,candev}(ndev); drivers/net/ethernet/freescale/fec_main.c:3995 fec_drv_remove() error: Using fep after free_{netdev,candev}(ndev); Since fep pointer is netdev private data, accessing it after free_netdev() call can cause use-after-free bug. Fix it by moving free_netdev() call at the end of the function Reported-by: Dan Carpenter Fixes: a31eda65ba21 ("net: fec: fix clock count mis-match") Signed-off-by: Pavel Skripkin Reviewed-by: Joakim Zhang Reviewed-by: Jesse Brandeburg Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin --- drivers/net/ethernet/freescale/fec_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c index 6b9eada1feb2..3fc823e9cdc9 100644 --- a/drivers/net/ethernet/freescale/fec_main.c +++ b/drivers/net/ethernet/freescale/fec_main.c @@ -3733,13 +3733,13 @@ fec_drv_remove(struct platform_device *pdev) if (of_phy_is_fixed_link(np)) of_phy_deregister_fixed_link(np); of_node_put(fep->phy_node); - free_netdev(ndev); clk_disable_unprepare(fep->clk_ahb); clk_disable_unprepare(fep->clk_ipg); pm_runtime_put_noidle(&pdev->dev); pm_runtime_disable(&pdev->dev); + free_netdev(ndev); return 0; } -- 2.30.2