linux-kernel - [PATCH 1/1] stmmac: bugfix oops on rmmod after ifconfig

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <1428923713-2419-2-git-send-email-pure.logic@nexus-software.ie>
Date:	Mon, 13 Apr 2015 12:15:13 +0100
From:	Bryan O'Donoghue <pure.logic@...us-software.ie>
To:	peppe.cavallaro@...com, netdev@...r.kernel.org, davem@...emloft.net
Cc:	andriy.shevchenko@...ux.intel.com, hock.leong.kweh@...el.com,
	boon.leong.ong@...el.com, dan.odonovan@...tex.com,
	linux-kernel@...r.kernel.org,
	Bryan O'Donoghue <pure.logic@...us-software.ie>
Subject: [PATCH 1/1] stmmac: bugfix oops on rmmod after ifconfig

An oops exists in the flow of stmmac_release().
phy_ethtool_get_wol() depends on phydev->drv which will be null in
stmmac_dvr_remove after stmmac_mdio_unreg() completes.

Steps to reproduce on Quark X1000:

1. ifconfig eth0 192.168.0.1
2. rmmod stmmac_pci

This patch re-orders the calling of the unreg() functions so that
stmmac_unreg_mdio() happens later in the release() routine thus avoiding the
null pointer dereference.

Signed-off-by: Bryan O'Donoghue <pure.logic@...us-software.ie>
Reported-by: Dan O'Donovan <dan.odonovan@...tex.com>

---
 drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index a0ea84f..3ab3e4a8 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -2958,14 +2958,14 @@ int stmmac_dvr_remove(struct net_device *ndev)
 	priv->hw->dma->stop_tx(priv->ioaddr);
 
 	stmmac_set_mac(priv->ioaddr, false);
-	if (priv->pcs != STMMAC_PCS_RGMII && priv->pcs != STMMAC_PCS_TBI &&
-	    priv->pcs != STMMAC_PCS_RTBI)
-		stmmac_mdio_unregister(ndev);
 	netif_carrier_off(ndev);
 	unregister_netdev(ndev);
 	if (priv->stmmac_rst)
 		reset_control_assert(priv->stmmac_rst);
 	clk_disable_unprepare(priv->stmmac_clk);
+	if (priv->pcs != STMMAC_PCS_RGMII && priv->pcs != STMMAC_PCS_TBI &&
+	    priv->pcs != STMMAC_PCS_RTBI)
+		stmmac_mdio_unregister(ndev);
 	free_netdev(ndev);
 
 	return 0;
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/