Skip to contentSkip to conversation

cpmac: use after free

PATCH Applied Dan Carpenter 3 participants 3 messages Mar 3, 2010

Subsystems (3)
Networking Network drivers Kernel janitors
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 cpmac: use after free

The original code dereferenced "cpmac_mii" after calling "mdiobus_free(cpmac_mii);"

Signed-off-by Dan Carpenter <[email protected]>

---
Found by a static checker and not tested. Sorry. :/

drivers/net/cpmac.c +1 -1
index b85c81f..9d48942 100644
@@ -1290,8 +1290,8 @@ void __devexit cpmac_exit(void)
 {
 	platform_driver_unregister(&cpmac_driver);
 	mdiobus_unregister(cpmac_mii);
-	mdiobus_free(cpmac_mii);
 	iounmap(cpmac_mii->priv);
+	mdiobus_free(cpmac_mii);
 }
 
 module_init(cpmac_init);
Reviewed-by on v1 1/1
#1 lore raw
Quoted 12 lines · Wed, Mar 03, 2010 at 09:46:10AM CET, [email protected] wrote:

The original code dereferenced "cpmac_mii" after calling "mdiobus_free(cpmac_mii);"

Signed-off-by Dan Carpenter <[email protected]>

---
Found by a static checker and not tested. Sorry. :/

drivers/net/cpmac.c +0 -0
index b85c81f..9d48942 100644

drivers/net/cpmac.c void __devexit cpmac_exit(void) · line 1297

Quoted 9 lines
drivers/net/cpmac.c +1 -1
@@ -1290,8 +1290,8 @@ void __devexit cpmac_exit(void)
 {
 	platform_driver_unregister(&cpmac_driver);
 	mdiobus_unregister(cpmac_mii);
-	mdiobus_free(cpmac_mii);
 	iounmap(cpmac_mii->priv);
+	mdiobus_free(cpmac_mii);
 }
 
 module_init(cpmac_init);

Looks good. Thanks.

Reviewed-by Jiri Pirko <[email protected]>
maintainer Applied
#2 lore raw

From: Jiri Pirko <[email protected]>
Date: Wed, 3 Mar 2010 09:59:58 +0100

Quoted 21 lines
Quoted 20 lines · Wed, Mar 03, 2010 at 09:46:10AM CET, [email protected] wrote:

The original code dereferenced "cpmac_mii" after calling "mdiobus_free(cpmac_mii);"

Signed-off-by Dan Carpenter <[email protected]>

---
Found by a static checker and not tested. Sorry. :/

drivers/net/cpmac.c +1 -1
index b85c81f..9d48942 100644
@@ -1290,8 +1290,8 @@ void __devexit cpmac_exit(void)
 {
 	platform_driver_unregister(&cpmac_driver);
 	mdiobus_unregister(cpmac_mii);
-	mdiobus_free(cpmac_mii);
 	iounmap(cpmac_mii->priv);
+	mdiobus_free(cpmac_mii);
 }
Quoted 5 lines

drivers/net/cpmac.c void __devexit cpmac_exit(void) · line 1297

Quoted 1 line
drivers/net/cpmac.c +0 -0
 module_init(cpmac_init);

Looks good. Thanks.

Reviewed-by Jiri Pirko <[email protected]>

Applied.