diff mbox series

[4.9,20/60] net: ti: fix UAF in tlan_remove_one

Message ID	20210726153825.506530218@linuxfoundation.org
State	Superseded
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Pavel Skripkin <paskripkin@gmail.com>, "David S. Miller" <davem@davemloft.net> Subject: [PATCH 4.9 20/60] net: ti: fix UAF in tlan_remove_one Date: Mon, 26 Jul 2021 17:38:34 +0200 Message-Id: <20210726153825.506530218@linuxfoundation.org> In-Reply-To: <20210726153824.868160836@linuxfoundation.org> References: <20210726153824.868160836@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [4.9,02/60] ARM: dts: rockchip: Fix power-controller node names for rk3288 [4.9,04/60] ARM: brcmstb: dts: fix NAND nodes names [4.9,05/60] ARM: dts: BCM63xx: Fix NAND nodes names [4.9,07/60] ARM: imx: pm-imx5: Fix references to imx5_cpu_suspend_info [4.9,09/60] arm64: dts: juno: Update SCPI nodes as per the YAML schema [4.9,10/60] thermal/core: Correct function name thermal_zone_device_unregister() [4.9,13/60] scsi: aic7xxx: Fix unintentional sign extension issue on left shift of u8 [4.9,14/60] sched/fair: Fix CFS bandwidth hrtimer expiry type [4.9,16/60] net: bridge: sync fdb to new unicast-filtering ports [4.9,17/60] net: bcmgenet: Ensure all TX/RX queues DMAs are disabled [4.9,18/60] net: moxa: fix UAF in moxart_mac_probe [4.9,20/60] net: ti: fix UAF in tlan_remove_one [4.9,22/60] tcp: annotate data races around tp->mtu_info [4.9,24/60] ixgbe: Fix an error handling path in ixgbe_probe() [4.9,26/60] fm10k: Fix an error handling path in fm10k_probe() [4.9,27/60] e1000e: Fix an error handling path in e1000_probe() [4.9,29/60] igb: Check if num of q_vectors is smaller than max before array access [4.9,31/60] perf lzma: Close lzma stream on exit [4.9,35/60] s390/bpf: Perform r1 range checking before accessing jit->seen_reg[r1] [4.9,37/60] net: decnet: Fix sleeping inside in af_decnet [4.9,39/60] scsi: iscsi: Fix iface sysfs attr detection [4.9,41/60] Revert "USB: quirks: ignore remote wake-up on Fibocom L850-GL LTE modem" [4.9,44/60] s390/ftrace: fix ftrace_update_ftrace_func implementation [4.9,45/60] ALSA: sb: Fix potential ABBA deadlock in CSP driver [4.9,46/60] xhci: Fix lost USB 2 remote wake [4.9,48/60] usb: hub: Disable USB 3 device initiated lpm if exit latency is too high [4.9,50/60] usb: max-3421: Prevent corruption of freed memory [4.9,52/60] USB: serial: option: add support for u-blox LARA-R6 family [4.9,56/60] media: ngene: Fix out-of-bounds bug in ngene_command_config_free_buf() [4.9,58/60] iio: accel: bma180: Use explicit member assignment [4.9,59/60] iio: accel: bma180: Fix BMA25x bandwidth register values

Commit Message

Greg Kroah-Hartman July 26, 2021, 3:38 p.m. UTC

From: Pavel Skripkin <paskripkin@gmail.com>

commit 0336f8ffece62f882ab3012820965a786a983f70 upstream.

priv is netdev private data and it cannot be
used after free_netdev() call. Using priv after free_netdev()
can cause UAF bug. Fix it by moving free_netdev() at the end of the
function.

Fixes: 1e0a8b13d355 ("tlan: cancel work at remove path")
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/ti/tlan.c |    3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff mbox series

Patch

--- a/drivers/net/ethernet/ti/tlan.c
+++ b/drivers/net/ethernet/ti/tlan.c
@@ -313,9 +313,8 @@  static void tlan_remove_one(struct pci_d
 	pci_release_regions(pdev);
 #endif
 
-	free_netdev(dev);
-
 	cancel_work_sync(&priv->tlan_tqueue);
+	free_netdev(dev);
 }
 
 static void tlan_start(struct net_device *dev)