Received: by 2002:a05:6a10:c604:0:0:0:0 with SMTP id y4csp3759370pxt; Tue, 10 Aug 2021 10:39:27 -0700 (PDT) X-Google-Smtp-Source: ABdhPJyL46YuIzglNV29wC1XidgVMngTaFGUanNcrhxkl4kPK+1BsllSq3rKq4UMeyvMiV7PY6pn X-Received: by 2002:a17:906:76c1:: with SMTP id q1mr29764702ejn.156.1628617167062; Tue, 10 Aug 2021 10:39:27 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1628617167; cv=none; d=google.com; s=arc-20160816; b=K3/R3TAJjqqT5SFHPI6odr7Z/38ZIlU+bPRTypVBBVEEYbxaASi+Rf5KtOGsWG7cRr apOv+J1Ifz5MfgsKeD+E7Un1epNkwINc/DsA3iSEyyXpXCyhgOKDk9pPgDeldtpKBV82 xRl1tBiQFgwoadpMj6fFBHhQk0KWkEn6C3ofU8N0c6iCHdgvoI5XMFSToFjJ96OLDGAn JdyTeyx2PsVCVys5RC3QQoyYpKmrV4aP8D42oW8ji9tJdLCQXxKb2EyS/cr0qh3UEcGt GDMNjMafqdEEaV2hcn6hNNGm+1S/Y519g32AxO4+3BMd4EPRR/cTXfVkLlC7MCe35kP0 CRLA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=MpAYJtjcZIc1oVyaM9IWpFbvEr8DRDWDMmyCBsaMOPQ=; b=iq1sPwz+NSXMzR0iymjTOq7Lh6hCzSWquMV6yW7laAuCk7YbyIIbdcaZ5A5ih2WrSn fNd0gQhSV4R6bRN/YOVYj+45SlNBTbEMT22qG1EZLc9lUR16zj8h9wB6foDABXktCaBA jWP9CqyMOBPO9WQyppD/IOmnefp/1q3DEeouwbFCryPEtLHTj/d+iA7BjUMj8gNiaMl6 x1RPLEreueCtQT+Pc/UpoK/FYORbbvuACeKdaRRopBhs19Uhe0rlGRwiD94L561SGQkK dFRPXZb+77rIKgBAKD34mS/J9epQP8Gkxvr4TcPBh34zkQxB+0lTt6U0kHbgAWZuwfwc w+sg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=fHlBobyp; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id ot3si6441904ejb.721.2021.08.10.10.39.02; Tue, 10 Aug 2021 10:39:27 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=fHlBobyp; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233868AbhHJRgS (ORCPT + 99 others); Tue, 10 Aug 2021 13:36:18 -0400 Received: from mail.kernel.org ([198.145.29.99]:41122 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233181AbhHJRe7 (ORCPT ); Tue, 10 Aug 2021 13:34:59 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 8DA3D61076; Tue, 10 Aug 2021 17:34:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1628616877; bh=D9Gsuly4zv0e7LkvpJQJKwFXOYRPw+lmGSMbLCSDW9k=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=fHlBobypHGwl3HOs0pYr4IK5ZZ0wyUrrUHfQZzjDnme/S4DKzyFEM6I+THsqvjFA+ 7P7YI1uTj2sCNhOyUeilnXCmAt55KYG1dFeFcZjuqwD0Y1M4shJ+vJw5TTv2Uziqlw W/JxHURAjSOTAezhT/7WYfZcnKJTHSn7cJReXw/A= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dan Carpenter , Pavel Skripkin , Joakim Zhang , Jesse Brandeburg , Jakub Kicinski , Sasha Levin Subject: [PATCH 5.4 32/85] net: fec: fix use-after-free in fec_drv_remove Date: Tue, 10 Aug 2021 19:30:05 +0200 Message-Id: <20210810172949.285492024@linuxfoundation.org> X-Mailer: git-send-email 2.32.0 In-Reply-To: <20210810172948.192298392@linuxfoundation.org> References: <20210810172948.192298392@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Pavel Skripkin [ Upstream commit 44712965bf12ae1758cec4de53816ed4b914ca1a ] Smatch says: drivers/net/ethernet/freescale/fec_main.c:3994 fec_drv_remove() error: Using fep after free_{netdev,candev}(ndev); drivers/net/ethernet/freescale/fec_main.c:3995 fec_drv_remove() error: Using fep after free_{netdev,candev}(ndev); Since fep pointer is netdev private data, accessing it after free_netdev() call can cause use-after-free bug. Fix it by moving free_netdev() call at the end of the function Reported-by: Dan Carpenter Fixes: a31eda65ba21 ("net: fec: fix clock count mis-match") Signed-off-by: Pavel Skripkin Reviewed-by: Joakim Zhang Reviewed-by: Jesse Brandeburg Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin --- drivers/net/ethernet/freescale/fec_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c index b1856552ab81..a53c2d637a97 100644 --- a/drivers/net/ethernet/freescale/fec_main.c +++ b/drivers/net/ethernet/freescale/fec_main.c @@ -3781,13 +3781,13 @@ fec_drv_remove(struct platform_device *pdev) if (of_phy_is_fixed_link(np)) of_phy_deregister_fixed_link(np); of_node_put(fep->phy_node); - free_netdev(ndev); clk_disable_unprepare(fep->clk_ahb); clk_disable_unprepare(fep->clk_ipg); pm_runtime_put_noidle(&pdev->dev); pm_runtime_disable(&pdev->dev); + free_netdev(ndev); return 0; } -- 2.30.2