[PATCH 5.11 152/254] can: c_can_pci: c_can_pci_remove(): fix use-after-free

[Greg Kroah-Hartman]

From: Tong Zhang <ztong0...@gmail.com>

[ Upstream commit 0429d6d89f97ebff4f17f13f5b5069c66bde8138 ]

There is a UAF in c_can_pci_remove(). dev is released by
free_c_can_dev() and is used by pci_iounmap(pdev, priv->base) later.
To fix this issue, save the mmio address before releasing dev.

Fixes: 5b92da0443c2 ("c_can_pci: generic module for C_CAN/D_CAN on PCI")
Link: https://lore.kernel.org/r/20210301024512.539039-1-ztong0...@gmail.com
Signed-off-by: Tong Zhang <ztong0...@gmail.com>
Signed-off-by: Marc Kleine-Budde <m...@pengutronix.de>
Signed-off-by: Sasha Levin <sas...@kernel.org>
---
 drivers/net/can/c_can/c_can_pci.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/can/c_can/c_can_pci.c 
b/drivers/net/can/c_can/c_can_pci.c
index 406b4847e5dc..7efb60b50876 100644
--- a/drivers/net/can/c_can/c_can_pci.c
+++ b/drivers/net/can/c_can/c_can_pci.c
@@ -239,12 +239,13 @@ static void c_can_pci_remove(struct pci_dev *pdev)
 {
        struct net_device *dev = pci_get_drvdata(pdev);
        struct c_can_priv *priv = netdev_priv(dev);
+       void __iomem *addr = priv->base;
 
        unregister_c_can_dev(dev);
 
        free_c_can_dev(dev);
 
-       pci_iounmap(pdev, priv->base);
+       pci_iounmap(pdev, addr);
        pci_disable_msi(pdev);
        pci_clear_master(pdev);
        pci_release_regions(pdev);
-- 
2.30.1