From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from phobos.denx.de (phobos.denx.de [85.214.62.61]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 90B1CC4321E for ; Wed, 30 Nov 2022 16:43:06 +0000 (UTC) Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id 1256985253; Wed, 30 Nov 2022 17:43:04 +0100 (CET) Authentication-Results: phobos.denx.de; dmarc=none (p=none dis=none) header.from=denx.de Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=denx.de; s=phobos-20191101; t=1669826584; bh=AiWPcTha59A9koDYYLnWXyeqXd2B+f0kKNlSDuT9otY=; h=From:To:Cc:Subject:Date:List-Id:List-Unsubscribe:List-Archive: List-Post:List-Help:List-Subscribe:From; b=Y5TG57xUEvc2KdmorchCi6ALgZ2ecTVV4KnagWuBEnnMcQtDYOk4JJUxVg5c3RoFr +iCS/CI8q3nROAOybXJ1PwLzqSrUhO4pW2tSG5JG/CEvltqNsQjtuHeycRfMxPrmtB c5/OVc9FJlhz1LTmVPOAepxatNFhvl/5ehxH/MN7YPIEOyiJAt7ztjk7QYznPUsbQU YR70s0Mled+LgsQlD/FuGwSxNR5Z5Hr7NCtMAqhEPYPxJha/SxQMc+QG0mY/NUjJbm zaFdld8WBc5Q23bK4nwZUnAxminlRUAU5HoxzedMKI+mWYwcd+ZEOZgPJFY87jhY/o S3H9xDjS20nCQ== Received: from aldebaran.denx.de (unknown [62.91.23.180]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) (No client certificate requested) (Authenticated sender: lusus@denx.de) by phobos.denx.de (Postfix) with ESMTPSA id CA46980FF4; Wed, 30 Nov 2022 17:43:01 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=denx.de; s=phobos-20191101; t=1669826582; bh=AiWPcTha59A9koDYYLnWXyeqXd2B+f0kKNlSDuT9otY=; h=From:To:Cc:Subject:Date:From; b=hHv9kMoLjVOn1ZYpQ+Pa9T7uuTdbq1ZouNLrV4UKXa43FL7xo2qaw7MI+cSP9JeH2 NuO2YMXyqnIM9xb0rY3GyXZQS/C3BKN2iOanB9dJ7rw0Ed/oy/vOJ4kfIuCBwCCTun 8n+64VfNG1UKWl+7ij7U5lW/0d6O9PnkyWFEbhzYo5xtmnLavOQ+G4R3GATBHuYBs8 bY7YXru/3wlNlsaFQdJamfq8jmUtOhOCy3VPEvHZQkjj0Yq49CG/7nfOOmc5CzAmF0 uWjaIZiLM/aENejEl/B8rSP9DuhxF0WMTAl0F8nUiBR9+X5fGIIJ7NrSy8wS2DLsbj aywJRVS/qD0AA== From: Niel Fourie To: u-boot@lists.denx.de Cc: Niel Fourie , Ramon Fried , Marek Vasut , Lukasz Majewski Subject: [PATCH] net: eth-uclass: change state before stop() in eth_halt() Date: Wed, 30 Nov 2022 17:42:25 +0100 Message-Id: <20221130164225.766877-1-lusus@denx.de> X-Mailer: git-send-email 2.38.1 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.39 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.103.6 at phobos.denx.de X-Virus-Status: Clean In eth_halt(), change the private uclass state before calling stop() instead of afterwards, to avoid writing to memory which may have been freed during stop(). In the ethernet gadget implementation, the gadget device gets probed during start() and removed during stop(), which includes freeing `uclass_priv_` to which `priv` is pointing. Writing to `priv` after stop() may corrupt the `fd` member of `struct malloc_chunk`, which represents the freed block, and could cause hard-to-debug crashes on subsequent calls to malloc()/free(). Signed-off-by: Niel Fourie Cc: Ramon Fried Cc: Marek Vasut Cc: Lukasz Majewski --- net/eth-uclass.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/eth-uclass.c b/net/eth-uclass.c index f41da4b37b3..bc3b9751e32 100644 --- a/net/eth-uclass.c +++ b/net/eth-uclass.c @@ -342,9 +342,9 @@ void eth_halt(void) if (!priv || !priv->running) return; - eth_get_ops(current)->stop(current); priv->state = ETH_STATE_PASSIVE; priv->running = false; + eth_get_ops(current)->stop(current); } int eth_is_active(struct udevice *dev) -- 2.38.1