| Message ID | 20211116151712.14338-1-paskripkin@gmail.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 9b5a333272a48c2f8b30add7a874e46e8b26129c |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [v2] net: dpaa2-eth: fix use-after-free in dpaa2_eth_remove | expand |
Hello: This patch was applied to netdev/net.git (master) by David S. Miller <davem@davemloft.net>: On Tue, 16 Nov 2021 18:17:12 +0300 you wrote: > Access to netdev after free_netdev() will cause use-after-free bug. > Move debug log before free_netdev() call to avoid it. > > Fixes: 7472dd9f6499 ("staging: fsl-dpaa2/eth: Move print message") > Signed-off-by: Pavel Skripkin <paskripkin@gmail.com> > --- > > [...] Here is the summary with links: - [v2] net: dpaa2-eth: fix use-after-free in dpaa2_eth_remove https://git.kernel.org/netdev/net/c/9b5a333272a4 You are awesome, thank you!
diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c index 714e961e7a77..6451c8383639 100644 --- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c +++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c @@ -4550,10 +4550,10 @@ static int dpaa2_eth_remove(struct fsl_mc_device *ls_dev) fsl_mc_portal_free(priv->mc_io); - free_netdev(net_dev); - dev_dbg(net_dev->dev.parent, "Removed interface %s\n", net_dev->name); + free_netdev(net_dev); + return 0; }
Access to netdev after free_netdev() will cause use-after-free bug. Move debug log before free_netdev() call to avoid it. Fixes: 7472dd9f6499 ("staging: fsl-dpaa2/eth: Move print message") Signed-off-by: Pavel Skripkin <paskripkin@gmail.com> --- Changes in v2: replaced Cc: stable with Fixes: tag --- drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)