|
Takashi Iwai |
d1d7ea |
From 0429d6d89f97ebff4f17f13f5b5069c66bde8138 Mon Sep 17 00:00:00 2001
|
|
Takashi Iwai |
d1d7ea |
From: Tong Zhang <ztong0001@gmail.com>
|
|
Takashi Iwai |
d1d7ea |
Date: Sun, 28 Feb 2021 21:45:11 -0500
|
|
Takashi Iwai |
d1d7ea |
Subject: [PATCH] can: c_can_pci: c_can_pci_remove(): fix use-after-free
|
|
Takashi Iwai |
d1d7ea |
Git-commit: 0429d6d89f97ebff4f17f13f5b5069c66bde8138
|
|
Takashi Iwai |
d1d7ea |
Patch-mainline: v5.12-rc5
|
|
Takashi Iwai |
d1d7ea |
References: git-fixes
|
|
Takashi Iwai |
d1d7ea |
|
|
Takashi Iwai |
d1d7ea |
There is a UAF in c_can_pci_remove(). dev is released by
|
|
Takashi Iwai |
d1d7ea |
free_c_can_dev() and is used by pci_iounmap(pdev, priv->base) later.
|
|
Takashi Iwai |
d1d7ea |
To fix this issue, save the mmio address before releasing dev.
|
|
Takashi Iwai |
d1d7ea |
|
|
Takashi Iwai |
d1d7ea |
Fixes: 5b92da0443c2 ("c_can_pci: generic module for C_CAN/D_CAN on PCI")
|
|
Takashi Iwai |
d1d7ea |
Link: https://lore.kernel.org/r/20210301024512.539039-1-ztong0001@gmail.com
|
|
Takashi Iwai |
d1d7ea |
Signed-off-by: Tong Zhang <ztong0001@gmail.com>
|
|
Takashi Iwai |
d1d7ea |
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
|
|
Takashi Iwai |
d1d7ea |
Acked-by: Takashi Iwai <tiwai@suse.de>
|
|
Takashi Iwai |
d1d7ea |
|
|
Takashi Iwai |
d1d7ea |
---
|
|
Takashi Iwai |
d1d7ea |
drivers/net/can/c_can/c_can_pci.c | 3 ++-
|
|
Takashi Iwai |
d1d7ea |
1 file changed, 2 insertions(+), 1 deletion(-)
|
|
Takashi Iwai |
d1d7ea |
|
|
Takashi Iwai |
d1d7ea |
diff --git a/drivers/net/can/c_can/c_can_pci.c b/drivers/net/can/c_can/c_can_pci.c
|
|
Takashi Iwai |
d1d7ea |
index 406b4847e5dc..7efb60b50876 100644
|
|
Takashi Iwai |
d1d7ea |
--- a/drivers/net/can/c_can/c_can_pci.c
|
|
Takashi Iwai |
d1d7ea |
+++ b/drivers/net/can/c_can/c_can_pci.c
|
|
Takashi Iwai |
d1d7ea |
@@ -239,12 +239,13 @@ static void c_can_pci_remove(struct pci_dev *pdev)
|
|
Takashi Iwai |
d1d7ea |
{
|
|
Takashi Iwai |
d1d7ea |
struct net_device *dev = pci_get_drvdata(pdev);
|
|
Takashi Iwai |
d1d7ea |
struct c_can_priv *priv = netdev_priv(dev);
|
|
Takashi Iwai |
d1d7ea |
+ void __iomem *addr = priv->base;
|
|
Takashi Iwai |
d1d7ea |
|
|
Takashi Iwai |
d1d7ea |
unregister_c_can_dev(dev);
|
|
Takashi Iwai |
d1d7ea |
|
|
Takashi Iwai |
d1d7ea |
free_c_can_dev(dev);
|
|
Takashi Iwai |
d1d7ea |
|
|
Takashi Iwai |
d1d7ea |
- pci_iounmap(pdev, priv->base);
|
|
Takashi Iwai |
d1d7ea |
+ pci_iounmap(pdev, addr);
|
|
Takashi Iwai |
d1d7ea |
pci_disable_msi(pdev);
|
|
Takashi Iwai |
d1d7ea |
pci_clear_master(pdev);
|
|
Takashi Iwai |
d1d7ea |
pci_release_regions(pdev);
|
|
Takashi Iwai |
d1d7ea |
--
|
|
Takashi Iwai |
d1d7ea |
2.26.2
|
|
Takashi Iwai |
d1d7ea |
|