Received: by 2002:a05:6a10:c604:0:0:0:0 with SMTP id y4csp3775338pxt; Tue, 10 Aug 2021 11:03:07 -0700 (PDT) X-Google-Smtp-Source: ABdhPJxNkwRMiuv/Q6NPgBk1u1TyQdO1V1Bpu+82FZS9M5e+oLs5D4nyKo1L5hNA8kLC87GqlmXa X-Received: by 2002:a17:906:388b:: with SMTP id q11mr28570423ejd.113.1628618587575; Tue, 10 Aug 2021 11:03:07 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1628618587; cv=none; d=google.com; s=arc-20160816; b=zPmu+Cndlqie+9YD5Fa9FG9SxGBdBCNUg5GQ4li6eIqo+YRMh7s3AVpz+GhcpRW34V r9rHQReSM06Tly/a9oLbTZWu0UcVjbRVUd7tl1zr0eV0dyTnQVTkY3AKNqRfun1ht+Co I4DiCT0LB4yoSK58+BZsWFNSvBLGGrAOKeNIEvAeK7eDuB4Pl/wDDnd45JZm6kKLFrfK xi0IljOfnPt+XqXInvjsFmtvlsz2Xsqdtkmkin9muJ704zMkSGfOsSGENHhPV5SlEZiT Aa0LLvMbdwKynV41WuWdqo628tn95/bJ9R1OXNe6z3yDVRf6ZHPMVpuQi9PPHfY+kZ8s aGpg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=b+pqV11de2dGalfCz3MhBFq3xK8FRXYKprR4pwRmutc=; b=z96lzoZumaC1fv4qHsW70oilGjqKMoJTQii0T4D3HBz1bnPOg0LoMq/PmHv2dsrfpH SHuYcJekeXZFUBJneWSNpLoniMrS1DKW1CSj7NuEF1FziIxGG8zSA5A27ksofrfrk4pG lemsXa+vsHL1BCpYqatMeHIkHqKIvnCIcL1awjoC2me3GinW5Mm7FN2fXCsecZt9P1La OLxOLV7heyZ6CULo57ja9RpQ8Zp674OC+W1B+Fz8oIO0TNpmUnFM805oMBIIAXm47Oj4 sS0X4BemCSPNgxnP6UeY/GvoIT9UFDRAQoE+0DIbjv2s+dBX4GGTpFKpZaAQFFJ/scNI NxaQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=2lKVvAJL; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id ke5si21335053ejc.8.2021.08.10.11.02.42; Tue, 10 Aug 2021 11:03:07 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=2lKVvAJL; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232002AbhHJSA7 (ORCPT + 99 others); Tue, 10 Aug 2021 14:00:59 -0400 Received: from mail.kernel.org ([198.145.29.99]:60120 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237352AbhHJR5W (ORCPT ); Tue, 10 Aug 2021 13:57:22 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 0EDF8613A2; Tue, 10 Aug 2021 17:45:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1628617533; bh=f5h8gMcCmz+1JgWild/a3ycWzNSLthoztW/TI5KG2gg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=2lKVvAJLXWD0C+d1wJGACTpB0r3l0Cbifteo67/8dsSa9Jo0fQlBQ5BFBHNL+osiK iKFgw3VVsIpJsaTX6MwpNdBaPDHe2YxVZWE7pKrCW/cl4MhfDL5lSMJ6PzE4B5mn5R iVobj5eSSrI4fvDH+WDmpthmKDDVO3fm015H1+KA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dan Carpenter , Pavel Skripkin , Joakim Zhang , Jesse Brandeburg , Jakub Kicinski , Sasha Levin Subject: [PATCH 5.13 067/175] net: fec: fix use-after-free in fec_drv_remove Date: Tue, 10 Aug 2021 19:29:35 +0200 Message-Id: <20210810173003.143651941@linuxfoundation.org> X-Mailer: git-send-email 2.32.0 In-Reply-To: <20210810173000.928681411@linuxfoundation.org> References: <20210810173000.928681411@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Pavel Skripkin [ Upstream commit 44712965bf12ae1758cec4de53816ed4b914ca1a ] Smatch says: drivers/net/ethernet/freescale/fec_main.c:3994 fec_drv_remove() error: Using fep after free_{netdev,candev}(ndev); drivers/net/ethernet/freescale/fec_main.c:3995 fec_drv_remove() error: Using fep after free_{netdev,candev}(ndev); Since fep pointer is netdev private data, accessing it after free_netdev() call can cause use-after-free bug. Fix it by moving free_netdev() call at the end of the function Reported-by: Dan Carpenter Fixes: a31eda65ba21 ("net: fec: fix clock count mis-match") Signed-off-by: Pavel Skripkin Reviewed-by: Joakim Zhang Reviewed-by: Jesse Brandeburg Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin --- drivers/net/ethernet/freescale/fec_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c index 8aea707a65a7..7e4c4980ced7 100644 --- a/drivers/net/ethernet/freescale/fec_main.c +++ b/drivers/net/ethernet/freescale/fec_main.c @@ -3843,13 +3843,13 @@ fec_drv_remove(struct platform_device *pdev) if (of_phy_is_fixed_link(np)) of_phy_deregister_fixed_link(np); of_node_put(fep->phy_node); - free_netdev(ndev); clk_disable_unprepare(fep->clk_ahb); clk_disable_unprepare(fep->clk_ipg); pm_runtime_put_noidle(&pdev->dev); pm_runtime_disable(&pdev->dev); + free_netdev(ndev); return 0; } -- 2.30.2