From 873725cfa035a170cbdf7ecc80f6ec72850950a1 Mon Sep 17 00:00:00 2001

From: Pavel Skripkin <paskripkin@gmail.com>

Date: Fri, 18 Jun 2021 19:14:31 +0300

Subject: [PATCH 19/19] net: ethernet: ezchip: fix UAF in nps_enet_remove

Git-commit: e4b8700e07a86e8eab6916aa5c5ba99042c34089

Patch-mainline: v5.14-rc1

References: git-fixes

priv is netdev private data, but it is used

after free_netdev(). It can cause use-after-free when accessing priv

pointer. So, fix it by moving free_netdev() after netif_napi_del()

call.

Fixes: 0dd077093636 ("NET: Add ezchip ethernet driver")

Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>

Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: Denis Kirjanov <denis.kirjanov@suse.com>

---

 drivers/net/ethernet/ezchip/nps_enet.c | 2 +-

 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/ezchip/nps_enet.c b/drivers/net/ethernet/ezchip/nps_enet.c

index 659f1ad37e96..fbadf08b7c5d 100644

--- a/drivers/net/ethernet/ezchip/nps_enet.c

+++ b/drivers/net/ethernet/ezchip/nps_enet.c

@@ -658,8 +658,8 @@ static s32 nps_enet_remove(struct platform_device *pdev)

 	struct nps_enet_priv *priv = netdev_priv(ndev);

 	unregister_netdev(ndev);

-	free_netdev(ndev);

 	netif_napi_del(&priv->napi);

+	free_netdev(ndev);

 	return 0;

 }

-- 

2.16.4