Commit ed169b05 authored Aug 04, 2021 by Pavel Skripkin Committed by Greg Kroah-Hartman Aug 12, 2021

net: vxge: fix use-after-free in vxge_device_unregister



[ Upstream commit 942e560a3d3862dd5dee1411dbdd7097d29b8416 ]

Smatch says:
drivers/net/ethernet/neterion/vxge/vxge-main.c:3518 vxge_device_unregister() error: Using vdev after free_{netdev,candev}(dev);
drivers/net/ethernet/neterion/vxge/vxge-main.c:3518 vxge_device_unregister() error: Using vdev after free_{netdev,candev}(dev);
drivers/net/ethernet/neterion/vxge/vxge-main.c:3520 vxge_device_unregister() error: Using vdev after free_{netdev,candev}(dev);
drivers/net/ethernet/neterion/vxge/vxge-main.c:3520 vxge_device_unregister() error: Using vdev after free_{netdev,candev}(dev);

Since vdev pointer is netdev private data accessing it after free_netdev()
call can cause use-after-free bug. Fix it by moving free_netdev() call at
the end of the function

Fixes: 6cca2003 ("vxge: cleanup probe error paths")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Reviewed-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

parent c5549876

drivers/net/ethernet/neterion/vxge/vxge-main.c

+3 −3

Original line number	Diff line number	Diff line
		@@ -3524,13 +3524,13 @@ static void vxge_device_unregister(struct __vxge_hw_device *hldev)

		kfree(vdev->vpaths);

		/* we are safe to free it now */
		free_netdev(dev);

		vxge_debug_init(vdev->level_trace, "%s: ethernet device unregistered",
		buf);
		vxge_debug_entryexit(vdev->level_trace, "%s: %s:%d Exiting...", buf,
		__func__, __LINE__);

		/* we are safe to free it now */
		free_netdev(dev);
		}

		/*