> I only noticed because I needed to add a free of the ug_info in a later
> patch.
Where, ironically, I add a use-after-free bug by freeing ug_info before
the ucc_geth_memclean() call.
:facepalm:
On 05/12/2020 22.19, Jakub Kicinski wrote:
> On Sat, 5 Dec 2020 22:04:28 +0100 Rasmus Villemoes wrote:
>> On 05/12/2020 21.48, Jakub Kicinski wrote:
>>> On Sat, 5 Dec 2020 20:17:34 +0100 Rasmus Villemoes wrote:
- unregister_netdev(dev);
- free_netdev(dev);
On Sat, 5 Dec 2020 22:04:28 +0100 Rasmus Villemoes wrote:
> On 05/12/2020 21.48, Jakub Kicinski wrote:
> > On Sat, 5 Dec 2020 20:17:34 +0100 Rasmus Villemoes wrote:
> >> - unregister_netdev(dev);
> >> - free_netdev(dev);
> >>ucc_geth_memclean(ugeth);
> >>if (of_phy_is_fixed_link(np))
On 05/12/2020 21.48, Jakub Kicinski wrote:
> On Sat, 5 Dec 2020 20:17:34 +0100 Rasmus Villemoes wrote:
>> -unregister_netdev(dev);
>> -free_netdev(dev);
>> ucc_geth_memclean(ugeth);
>> if (of_phy_is_fixed_link(np))
>> of_phy_deregister_fixed_link(np);
>>
On Sat, 5 Dec 2020 20:17:34 +0100 Rasmus Villemoes wrote:
> - unregister_netdev(dev);
> - free_netdev(dev);
> ucc_geth_memclean(ugeth);
> if (of_phy_is_fixed_link(np))
> of_phy_deregister_fixed_link(np);
> of_node_put(ugeth->ug_info->tbi_node);
>
ugeth is the netdiv_priv() part of the netdevice. Accessing the memory
pointed to by ugeth (such as done by ucc_geth_memclean() and the two
of_node_puts) after free_netdev() is thus use-after-free.
Signed-off-by: Rasmus Villemoes
---
drivers/net/ethernet/freescale/ucc_geth.c | 4 ++--
1 file
6 matches
Mail list logo
