From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-dl1-f49.google.com (mail-dl1-f49.google.com [74.125.82.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id ED7132FA0C7 for ; Thu, 19 Feb 2026 23:41:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.82.49 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771544463; cv=none; b=fvCNUGw566PKicH43BIr5fcY34aABDKg4cMpd8ejRZGcr+UlutxmytIqfwZRRW7smsxB2tJFZDw/A/kjBUv5xqh4Qqku5jy7nzHl9GfELYhkkHLsvMAx5R0DHy51sOuVFOIzWx1HBj988ojVWKNRycogLfq/zAilYG46eFD3LDs= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771544463; c=relaxed/simple; bh=PMAPfIQEj675IqbisUBERbNkWF6o3Hukzf5k9lachTI=; h=Date:From:To:Cc:Subject:Message-ID:MIME-Version:Content-Type: Content-Disposition; b=tLYg+f3mTu7/4yaKiSlH8+LNEqVt9SaoCFkSQe7rkOJXExZyemw3Nj9fNe3FAHBwWUO4dS8RwDSPr8X7thZMcz8C0R5a8th6BlPrNQQpfDd5/CV8UEdc10JScMcpVEUeFoj2vMqH8q4Fn8GxxbjO2TDSHWD1TI7SjGkAj1J3fB8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=XR648izV; arc=none smtp.client-ip=74.125.82.49 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="XR648izV" Received: by mail-dl1-f49.google.com with SMTP id a92af1059eb24-127423bea4bso882107c88.0 for ; Thu, 19 Feb 2026 15:41:01 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1771544461; x=1772149261; darn=vger.kernel.org; h=content-disposition:mime-version:message-id:subject:cc:to:from:date :from:to:cc:subject:date:message-id:reply-to; bh=BofRrJoOgRuo4uPqIcmQDyXymqEuxMsCR5jwllsdETk=; b=XR648izV8WEmMbhF0uwsDAJNxEfsxmXZZO9u2hBuJm30jg0odRdD8gBhMQRdVzNzx6 n1olf8uf8Ff6MKEHg4uJjqC/a0qwvWC5MQ9hoOVK4MGY+TVfthghMkNTg2AQUq0PRlVu lblt/bkFQUv6DpwFkxN0u8mH9QjV3kU61oF6YZau+bafzHiIdIqR2PiAT2+g+un8+f0L plVYhri05juiB9HG2BZgWRVoJ91OBXbMGayXhPLSGEigX9NLPXWL/U3FLbxMxQiquG17 o4kzLPbD9HD0gAtfhQ0NxBJxku7yp7deIH28+JXMbacW4lYn6LOz90iH9j1CvfXk9dvE 9klA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1771544461; x=1772149261; h=content-disposition:mime-version:message-id:subject:cc:to:from:date :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=BofRrJoOgRuo4uPqIcmQDyXymqEuxMsCR5jwllsdETk=; b=HMtTD4bH9f55pZFq6U2eBRkLKHkO3jk1V7s2xZVUKMrkeKCyB+LF9VoRu/OvE2PMLc h6K608Dsj62a2inlmfwgAl/SOydbjXwREyJ8PXiRP1Be43xACRsoiorQXnW/TVAF0moa 0FGSBcumaq/S/tDrOBWhInvKmxGnAsQZ6vjeZYDliK8sTwOdTU0+UXGmh6ttUrfPJ9b1 UpVDi6LIMQYC84K5c2au97nKGhk8M3OMV3Jjlcdnl3fvqROb4m3Qv23cW7dcZ9B+9xU5 WKfaLBaFnsfEW4WNJ3LaL6r2mwv8mn6Hya4qEJxsmyiSDYVmCrCiNcGdC3DPCvQOkez3 vk+Q== X-Forwarded-Encrypted: i=1; AJvYcCXnzs/5FssLr0WTv1AmCzLPiC9Avw9/jZbRwMNRFc34gDOHrwHBmO10xBWcc8AdR0ZB3Zdptr5HiuCLT+o=@vger.kernel.org X-Gm-Message-State: AOJu0YzLqyK0p05n7N2ilOxospK90gHlj57Uyf8oc0da2HSe5ShxtfOl rVIbV5pKTfzF7K15F40amUqID5hWM26F+5FsiMJQVCnZVP7xqBVnUJQC X-Gm-Gg: AZuq6aKZTfr3jMiY3S0SfAGY5jXF/PzMNRlRToadADEv9/YYb0KLXaUUSAps+qEI49s l/hQb8+j18MvqA7+E81W6+UTC9KIIQbFbt4BXWp9SdLWw0FTvkyg8QbkIElzvaRhBqJ6Xef5Lbx HJ79Y9bh0XfiNGN1kvfXDfHt5UVffH0x3/gMhGSXFs6QsLvchiAoBMjStoeRl+6/oADWTrSJ7Ij 21HXY7Jl4GZUEOC4LApqha9af8NSa0R4fosGv6FGFKAEiXSSK+UvHeyOau7LtwAYEJWcIKhaaIf 5CPnmmli/seOMHqpZlXBRFVGJBPvOoqM43AoFjYYkrwIsUCQW3NWCtlopyx+n2Q+Sse8kcMZx0j KrWUvQ5vF9pKXqu1kwOwaRs9LCqwFOgL7Rqp6KAEjie6E6D+rovanMWX8pqfBnEu1VwUHE+M6jW 1n2ZUYkV2qt3LMW7I5tOU2GZIJ96LgTb9TKAeLVHqjjI3csx02wX7NF62keHf4rm3s X-Received: by 2002:a05:7022:128c:b0:127:874:af0a with SMTP id a92af1059eb24-1273adb37a3mr11907088c88.5.1771544460948; Thu, 19 Feb 2026 15:41:00 -0800 (PST) Received: from google.com ([2a00:79e0:2ebe:8:9c24:8181:603e:7ad7]) by smtp.gmail.com with ESMTPSA id a92af1059eb24-12742c6dc70sm23105356c88.8.2026.02.19.15.41.00 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 19 Feb 2026 15:41:00 -0800 (PST) Date: Thu, 19 Feb 2026 15:40:57 -0800 From: Dmitry Torokhov To: Andrew Lunn Cc: Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , "Rafael J. Wysocki" , Simon Horman , Zijun Hu , netdev@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH net] net: wan: framer: fix potential UAF in framer_provider_simple_of_xlate() Message-ID: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline The implementation put_device()s located device and then uses container_of() on the pointer. The device may disappear by that time, resulting in UAF. Fix the problem by keeping the reference to the framer device, and avoid getting an extra reference to it in framer_get(). Fixes: dcacb364772e ("net: wan: framer: Simplify API framer_provider_simple_of_xlate() implementation") Signed-off-by: Dmitry Torokhov --- drivers/net/wan/framer/framer-core.c | 3 --- 1 file changed, 3 deletions(-) diff --git a/drivers/net/wan/framer/framer-core.c b/drivers/net/wan/framer/framer-core.c index bf7ac7dd2804..397fabc3da4e 100644 --- a/drivers/net/wan/framer/framer-core.c +++ b/drivers/net/wan/framer/framer-core.c @@ -482,8 +482,6 @@ struct framer *framer_get(struct device *dev, const char *con_id) if (IS_ERR(framer)) return framer; - get_device(&framer->dev); - if (!try_module_get(framer->ops->owner)) { ret = -EPROBE_DEFER; goto err_put_device; @@ -749,7 +747,6 @@ struct framer *framer_provider_simple_of_xlate(struct device *dev, if (!target_dev) return ERR_PTR(-ENODEV); - put_device(target_dev); return dev_to_framer(target_dev); } EXPORT_SYMBOL_GPL(framer_provider_simple_of_xlate); -- 2.53.0.345.g96ddfc5eaa-goog -- Dmitry