[PATCH] eth: sp7021: fix use after free bug in spl2sw_nvmem_get_mac_address

[PATCH] eth: sp7021: fix use after free bug in spl2sw_nvmem_get_mac_address

[Zheng Wang]

This frees "mac" and tries to display its address as part of the error
message on the next line.  Swap the order.

Fixes: fd3040b9394c ("net: ethernet: Add driver for Sunplus SP7021")

Reported-by: Zheng Wang <hackerzheng666@gmail.com>

Signed-off-by: Zheng Wang <zyytlz.wz@163.com>
---
 drivers/net/ethernet/sunplus/spl2sw_driver.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/sunplus/spl2sw_driver.c b/drivers/net/ethernet/sunplus/spl2sw_driver.c
index 546206640492..61d1d07dc070 100644
--- a/drivers/net/ethernet/sunplus/spl2sw_driver.c
+++ b/drivers/net/ethernet/sunplus/spl2sw_driver.c
@@ -248,8 +248,8 @@ static int spl2sw_nvmem_get_mac_address(struct device *dev, struct device_node *
 
 	/* Check if mac address is valid */
 	if (!is_valid_ether_addr(mac)) {
-		kfree(mac);
 		dev_info(dev, "Invalid mac address in nvmem (%pM)!\n", mac);
+		kfree(mac);
 		return -EINVAL;
 	}
 
-- 
2.25.1

Re: [PATCH] eth: sp7021: fix use after free bug in spl2sw_nvmem_get_mac_address

[Jakub Kicinski]

On Fri, 30 Sep 2022 12:03:10 +0800 Zheng Wang wrote:
> This frees "mac" and tries to display its address as part of the error
> message on the next line.  Swap the order.
> 
> Fixes: fd3040b9394c ("net: ethernet: Add driver for Sunplus SP7021")
> 
> Reported-by: Zheng Wang <hackerzheng666@gmail.com>
> 
> Signed-off-by: Zheng Wang <zyytlz.wz@163.com>

Is there reporter and author the same person with different email
addresses or two people?

Re: [PATCH] eth: sp7021: fix use after free bug in spl2sw_nvmem_get_mac_address

[Zheng Hacker]

> Is there reporter and author the same person with different email
> addresses or two people?
>

Hi Jakub,
Yes, its the same person from different email count.

Regards,
Zheng Wang

Re: [PATCH] eth: sp7021: fix use after free bug in spl2sw_nvmem_get_mac_address

[Jakub Kicinski]

On Sat, 1 Oct 2022 01:23:52 +0800 Zheng Hacker wrote:
> > Is there reporter and author the same person with different email
> > addresses or two people?
> >  
> 
> Hi Jakub,
> Yes, its the same person from different email count.

Please repost without the Reported-by tag, then.
It's implied that you found the problem yourself
if there is no Reported-by tag.

Please remove the empty line between the Fixes
tag and you Signed-off-by tag.

Re: [PATCH] eth: sp7021: fix use after free bug in spl2sw_nvmem_get_mac_address

[Zheng Hacker]

> Please repost without the Reported-by tag, then.
> It's implied that you found the problem yourself
> if there is no Reported-by tag.
>
> Please remove the empty line between the Fixes
> tag and you Signed-off-by tag.

Hi Jakub,

I'll fix that and resend the patch right away. Thanks for your advice :)

Regards,
Zheng Wang

[PATCH] eth: sp7021: fix use after free bug in spl2sw_nvmem_get_mac_address

[Zheng Wang]

This frees "mac" and tries to display its address as part of the error
message on the next line.  Swap the order.

Fixes: fd3040b9394c ("net: ethernet: Add driver for Sunplus SP7021")
Signed-off-by: Zheng Wang <zyytlz.wz@163.com>
---
 drivers/net/ethernet/sunplus/spl2sw_driver.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/sunplus/spl2sw_driver.c b/drivers/net/ethernet/sunplus/spl2sw_driver.c
index 546206640492..61d1d07dc070 100644
--- a/drivers/net/ethernet/sunplus/spl2sw_driver.c
+++ b/drivers/net/ethernet/sunplus/spl2sw_driver.c
@@ -248,8 +248,8 @@ static int spl2sw_nvmem_get_mac_address(struct device *dev, struct device_node *
 
 	/* Check if mac address is valid */
 	if (!is_valid_ether_addr(mac)) {
-		kfree(mac);
 		dev_info(dev, "Invalid mac address in nvmem (%pM)!\n", mac);
+		kfree(mac);
 		return -EINVAL;
 	}
 
-- 
2.25.1

Re: [PATCH] eth: sp7021: fix use after free bug in spl2sw_nvmem_get_mac_address

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (master)
by David S. Miller <davem@davemloft.net>:

On Sat,  1 Oct 2022 01:57:25 +0800 you wrote:
> This frees "mac" and tries to display its address as part of the error
> message on the next line.  Swap the order.
> 
> Fixes: fd3040b9394c ("net: ethernet: Add driver for Sunplus SP7021")
> Signed-off-by: Zheng Wang <zyytlz.wz@163.com>
> ---
>  drivers/net/ethernet/sunplus/spl2sw_driver.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

Here is the summary with links:
  - eth: sp7021: fix use after free bug in spl2sw_nvmem_get_mac_address
    https://git.kernel.org/netdev/net/c/12aece8b0150

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html