Re: [PATCH] peak_pci: fix use after free in netdev teardown

[Marc Kleine-Budde <mkl@pengutronix.de>]

[-- Attachment #1: Type: text/plain, Size: 1873 bytes --]

On 04/09/2014 09:45 PM, Christopher R. Baker wrote:
> Hi All,
> 
> In the course of tracking down (and eventually backporting) a fix to one
> of my systems that is still running a 3.2 kernel, I noticed what I
> believe to be a pair of use-after-free bugs in peak_pci.c pertaining to
> the linked list of netdevs that is maintained for multi-port cards.
> These bugs persist in 3.14, so I thought I should send along a patch for
> review.
> 
> Basically, the "prev_dev" pointer that is used for this list lives in
> memory that is allocated by alloc_sja1000dev(), but it is referenced
> after the call to free_sja1000dev() when walking the list during
> teardown, both in the failure case of peak_pci_probe and in
> peak_pci_remove.  Unless I'm missing something, these are toes waiting
> to be stubbed...
> 
> Caveats:
>  - This is a growing blob of copy-pasta that should probably be
> refactored to a common location.  For example, peak_pci_remove could be
> restructured to incrementally check and free allocated resources,
> allowing the "failure_remove_channels" label to delegate the cleanup to
> peak_pci_remove.  I didn't want to bite off too much this time, though,
> so I left that alone.
>  - I don't have an expresscard adapter to check the placement of the
> pciec_remove stanzas.  By inspection, unregister_sja1000dev does not
> appear to have a path back to the pciec stuff, but I may have missed
> something.
> 
> -ChrisR
> 
> Signed-of-by: Christopher R. Baker <cbaker@rec.ri.cmu.edu>

Stephane, can you please have a look at the patch.

Marc

-- 
Pengutronix e.K.                  | Marc Kleine-Budde           |
Industrial Linux Solutions        | Phone: +49-231-2826-924     |
Vertretung West/Dortmund          | Fax:   +49-5121-206917-5555 |
Amtsgericht Hildesheim, HRA 2686  | http://www.pengutronix.de   |


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 242 bytes --]