Skip to contentSkip to conversation

phylib: fix potential use-after-free

PATCH Applied Marek Behún 3 participants 3 messages Jan 19, 2022 – Jan 21, 2022

Subsystems (3)
Networking Network drivers Ethernet PHY
lore
Share & tools
lore

Marek Behún

author
#0 lore raw

PATCH 1/1 phylib: fix potential use-after-free

Commit bafbdd527d56 ("phylib: Add device reset GPIO support") added call to phy_device_reset(phydev) after the put_device() call in phy_detach().

The comment before the put_device() call says that the phydev might go away with put_device().

Fix potential use-after-free by calling phy_device_reset() before put_device().

Fixes bafbdd527d56 ("phylib: Add device reset GPIO support")
Signed-off-by Marek Behún <[email protected]>
---
 drivers/net/phy/phy_device.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/net/phy/phy_device.c +3 -3
index 74d8e1dc125f..ce0bb5951b81 100644
@@ -1746,6 +1746,9 @@ void phy_detach(struct phy_device *phydev)
 	    phy_driver_is_genphy_10g(phydev))
 		device_release_driver(&phydev->mdio.dev);
 
+	/* Assert the reset signal */
+	phy_device_reset(phydev, 1);
+
 	/*
 	 * The phydev might go away on the put_device() below, so avoid
 	 * a use-after-free bug by reading the underlying bus first.

@@ -1757,9 +1760,6 @@ void phy_detach(struct phy_device *phydev)
 		ndev_owner = dev->dev.parent->driver->owner;
 	if (ndev_owner != bus->owner)
 		module_put(bus->owner);
-
-	/* Assert the reset signal */
-	phy_device_reset(phydev, 1);
 }
 EXPORT_SYMBOL(phy_detach);
Signature · 1 line
2.34.1
maintainer Reviewed-by on v1 1/1
#1 lore raw
Quoted 11 lines · Marek Behún

Commit bafbdd527d56 ("phylib: Add device reset GPIO support") added call to phy_device_reset(phydev) after the put_device() call in phy_detach().

The comment before the put_device() call says that the phydev might go away with put_device().

Fix potential use-after-free by calling phy_device_reset() before put_device().

Fixes bafbdd527d56 ("phylib: Add device reset GPIO support")
Signed-off-by Marek Behún <[email protected]>
Reviewed-by Andrew Lunn <[email protected]>

Andrew

CI Applied
#2 lore raw
In reply to Marek Behún
This patch was applied to netdev/net.git (master) by Jakub Kicinski <[email protected]>:

Hello:

This patch was applied to netdev/net.git (master)
by Jakub Kicinski <[email protected]>:

Quoted 10 lines · On Wed, 19 Jan 2022 17:27:48 +0100 you wrote:

Commit bafbdd527d56 ("phylib: Add device reset GPIO support") added call to phy_device_reset(phydev) after the put_device() call in phy_detach().

The comment before the put_device() call says that the phydev might go away with put_device().

Fix potential use-after-free by calling phy_device_reset() before put_device().

[...]

Here is the summary with links:
- [net] phylib: fix potential use-after-free

    https://git.kernel.org/netdev/net/c/cbda1b166875

You are awesome, thank you!

Signature · 2 lines
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html