Commit 51a04ebf authored by Vladimir Oltean's avatar Vladimir Oltean Committed by Jakub Kicinski

net: dsa: mv88e6xxx: fix use-after-free in mv88e6xxx_mdios_unregister

Since struct mv88e6xxx_mdio_bus *mdio_bus is the bus->priv of something
allocated with mdiobus_alloc_size(), this means that mdiobus_free(bus)
will free the memory backing the mdio_bus as well. Therefore, the
mdio_bus->list element is freed memory, but we continue to iterate
through the list of MDIO buses using that list element.

To fix this, use the proper list iterator that handles element deletion
by keeping a copy of the list element next pointer.

Fixes: f53a2ce8 ("net: dsa: mv88e6xxx: don't use devres for mdiobus")
Reported-by: default avatarRafael Richter <rafael.richter@gin.de>
Signed-off-by: default avatarVladimir Oltean <vladimir.oltean@nxp.com>
Link: https://lore.kernel.org/r/20220210174017.3271099-1-vladimir.oltean@nxp.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent a19f7d7d
...@@ -3449,10 +3449,10 @@ static int mv88e6xxx_mdio_register(struct mv88e6xxx_chip *chip, ...@@ -3449,10 +3449,10 @@ static int mv88e6xxx_mdio_register(struct mv88e6xxx_chip *chip,
static void mv88e6xxx_mdios_unregister(struct mv88e6xxx_chip *chip) static void mv88e6xxx_mdios_unregister(struct mv88e6xxx_chip *chip)
{ {
struct mv88e6xxx_mdio_bus *mdio_bus; struct mv88e6xxx_mdio_bus *mdio_bus, *p;
struct mii_bus *bus; struct mii_bus *bus;
list_for_each_entry(mdio_bus, &chip->mdios, list) { list_for_each_entry_safe(mdio_bus, p, &chip->mdios, list) {
bus = mdio_bus->bus; bus = mdio_bus->bus;
if (!mdio_bus->external) if (!mdio_bus->external)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment