lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Wed, 16 Jan 2019 22:42:04 +0100 From: Hauke Mehrtens <hauke@...ke-m.de> To: Johan Hovold <johan@...nel.org> Cc: Andrew Lunn <andrew@...n.ch>, Vivien Didelot <vivien.didelot@...il.com>, Florian Fainelli <f.fainelli@...il.com>, "David S. Miller" <davem@...emloft.net>, netdev@...r.kernel.org, linux-kernel@...r.kernel.org, stable <stable@...r.kernel.org> Subject: Re: [PATCH 1/3] net: dsa: lantiq_gswip: fix use-after-free on failed probe On 1/16/19 11:23 AM, Johan Hovold wrote: > Make sure to disable and deregister the switch on late probe errors to > avoid use-after-free when the device-resource-managed switch is freed. > > Fixes: 14fceff4771e ("net: dsa: Add Lantiq / Intel DSA driver for vrx200") > Cc: stable <stable@...r.kernel.org> # 4.20 > Cc: Hauke Mehrtens <hauke@...ke-m.de> > Signed-off-by: Johan Hovold <johan@...nel.org> Acked-by: Hauke Mehrtens <hauke@...ke-m.de> > --- > drivers/net/dsa/lantiq_gswip.c | 5 ++++- > 1 file changed, 4 insertions(+), 1 deletion(-) > > diff --git a/drivers/net/dsa/lantiq_gswip.c b/drivers/net/dsa/lantiq_gswip.c > index 693a67f45bef..b06c41c98de9 100644 > --- a/drivers/net/dsa/lantiq_gswip.c > +++ b/drivers/net/dsa/lantiq_gswip.c > @@ -1099,7 +1099,7 @@ static int gswip_probe(struct platform_device *pdev) > dev_err(dev, "wrong CPU port defined, HW only supports port: %i", > priv->hw_info->cpu_port); > err = -EINVAL; > - goto mdio_bus; > + goto disable_switch; > } > > platform_set_drvdata(pdev, priv); > @@ -1109,6 +1109,9 @@ static int gswip_probe(struct platform_device *pdev) > (version & GSWIP_VERSION_MOD_MASK) >> GSWIP_VERSION_MOD_SHIFT); > return 0; > > +disable_switch: > + gswip_mdio_mask(priv, GSWIP_MDIO_GLOB_ENABLE, 0, GSWIP_MDIO_GLOB); > + dsa_unregister_switch(priv->ds); > mdio_bus: > if (mdio_np) > mdiobus_unregister(priv->ds->slave_mii_bus); >
Powered by blists - more mailing lists