]> git.ipfire.org Git - people/arne_f/kernel.git/commit
can: c_can_pci: c_can_pci_remove(): fix use-after-free
authorTong Zhang <ztong0001@gmail.com>
Mon, 1 Mar 2021 02:45:11 +0000 (21:45 -0500)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 30 Mar 2021 12:41:40 +0000 (14:41 +0200)
commita78e15784231aec2979b829fabc4535f28cd4e6d
tree90ecafaac2cdeb7b04ad983cc7567a65089903d3
parent646b4ca277d488acbd0d9474c8f21f934be483db
can: c_can_pci: c_can_pci_remove(): fix use-after-free

[ Upstream commit 0429d6d89f97ebff4f17f13f5b5069c66bde8138 ]

There is a UAF in c_can_pci_remove(). dev is released by
free_c_can_dev() and is used by pci_iounmap(pdev, priv->base) later.
To fix this issue, save the mmio address before releasing dev.

Fixes: 5b92da0443c2 ("c_can_pci: generic module for C_CAN/D_CAN on PCI")
Link: https://lore.kernel.org/r/20210301024512.539039-1-ztong0001@gmail.com
Signed-off-by: Tong Zhang <ztong0001@gmail.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/net/can/c_can/c_can_pci.c