net: ethernet: fix UAF in ltq_etop_init
PATCH 1/1 net: ethernet: fix UAF in ltq_etop_init
In ltq_etop_init() netdev was used after free_netdev():
err_netdev:
unregister_netdev(dev); free_netdev(dev); err_hw: ltq_etop_hw_exit(dev); return err;
It causes use-after-free read/write in ltq_etop_hw_exit(). Fix it by rewriting error handling path in this function. No logic changes, only small refactoring.
Fixes ("MIPS: Lantiq: Add ethernet driver")
Signed-off-by Pavel Skripkin <[email protected]>
--- drivers/net/ethernet/lantiq_etop.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/net/ethernet/lantiq_etop.c +5 -4
@@ -553,8 +553,10 @@ ltq_etop_init(struct net_device *dev) dev->watchdog_timeo =10 *HZ ; err =ltq_etop_hw_init (dev); -if (err) - goto err_hw; +if (err) { +ltq_etop_hw_exit (dev); +return err; + }ltq_etop_change_mtu (dev,1500 );memcpy (&mac, &priv->pldata->mac,sizeof (struct sockaddr ));
@@ -580,9 +582,8 @@ ltq_etop_init(struct net_device *dev) err_netdev:unregister_netdev (dev); -free_netdev (dev); -err_hw:ltq_etop_hw_exit (dev); +free_netdev (dev);return err; }
Signature · 6 lines
2.32.0 _______________________________________________ Linux-kernel-mentees mailing list [email protected] https://lists.linuxfoundation.org/mailman/listinfo/linux-kernel-mentees