Commit 0429d6d8 authored by Tong Zhang's avatar Tong Zhang Committed by Marc Kleine-Budde

can: c_can_pci: c_can_pci_remove(): fix use-after-free

There is a UAF in c_can_pci_remove(). dev is released by
free_c_can_dev() and is used by pci_iounmap(pdev, priv->base) later.
To fix this issue, save the mmio address before releasing dev.

Fixes: 5b92da04 ("c_can_pci: generic module for C_CAN/D_CAN on PCI")
Link: https://lore.kernel.org/r/20210301024512.539039-1-ztong0001@gmail.comSigned-off-by: default avatarTong Zhang <ztong0001@gmail.com>
Signed-off-by: default avatarMarc Kleine-Budde <mkl@pengutronix.de>
parent 7507479c
...@@ -239,12 +239,13 @@ static void c_can_pci_remove(struct pci_dev *pdev) ...@@ -239,12 +239,13 @@ static void c_can_pci_remove(struct pci_dev *pdev)
{ {
struct net_device *dev = pci_get_drvdata(pdev); struct net_device *dev = pci_get_drvdata(pdev);
struct c_can_priv *priv = netdev_priv(dev); struct c_can_priv *priv = netdev_priv(dev);
void __iomem *addr = priv->base;
unregister_c_can_dev(dev); unregister_c_can_dev(dev);
free_c_can_dev(dev); free_c_can_dev(dev);
pci_iounmap(pdev, priv->base); pci_iounmap(pdev, addr);
pci_disable_msi(pdev); pci_disable_msi(pdev);
pci_clear_master(pdev); pci_clear_master(pdev);
pci_release_regions(pdev); pci_release_regions(pdev);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment