From 31affbc1293ce527d9077ba7a0945858a4c4ec32 Mon Sep 17 00:00:00 2001

From: Pavel Skripkin <paskripkin@gmail.com>

Date: Fri, 18 Jun 2021 17:57:31 +0300

Subject: [PATCH 16/16] net: ethernet: aeroflex: fix UAF in greth_of_remove

Git-commit: e3a5de6d81d8b2199935c7eb3f7d17a50a7075b7

Patch-mainline: v5.14-rc1

References: git-fixes

static int greth_of_remove(struct platform_device *of_dev)

{

...

	struct greth_private *greth = netdev_priv(ndev);

...

	unregister_netdev(ndev);

	free_netdev(ndev);

	of_iounmap(&of_dev->resource[0], greth->regs, resource_size(&of_dev->resource[0]));

...

}

greth is netdev private data, but it is used

after free_netdev(). It can cause use-after-free when accessing greth

pointer. So, fix it by moving free_netdev() after of_iounmap()

call.

Fixes: d4c41139df6e ("net: Add Aeroflex Gaisler 10/100/1G Ethernet MAC driver")

Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>

Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: Denis Kirjanov <denis.kirjanov@suse.com>

---

 drivers/net/ethernet/aeroflex/greth.c | 3 ++-

 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/aeroflex/greth.c b/drivers/net/ethernet/aeroflex/greth.c

index 4309be3724ad..a20e95b39cf7 100644

--- a/drivers/net/ethernet/aeroflex/greth.c

+++ b/drivers/net/ethernet/aeroflex/greth.c

@@ -1546,10 +1546,11 @@ static int greth_of_remove(struct platform_device *of_dev)

 	mdiobus_unregister(greth->mdio);

 	unregister_netdev(ndev);

-	free_netdev(ndev);

 	of_iounmap(&of_dev->resource[0], greth->regs, resource_size(&of_dev->resource[0]));

+	free_netdev(ndev);

+

 	return 0;

 }

-- 

2.16.4