diff mbox

cpmac: use after free

Message ID 20100303084610.GH5086@bicker
State Accepted, archived
Delegated to: David Miller
Headers show

Commit Message

Dan Carpenter March 3, 2010, 8:46 a.m. UTC
The original code dereferenced "cpmac_mii" after calling 
"mdiobus_free(cpmac_mii);"

Signed-off-by: Dan Carpenter <error27@gmail.com>
---
Found by a static checker and not tested.  Sorry.  :/

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Comments

Jiri Pirko March 3, 2010, 8:59 a.m. UTC | #1
Wed, Mar 03, 2010 at 09:46:10AM CET, error27@gmail.com wrote:
>The original code dereferenced "cpmac_mii" after calling 
>"mdiobus_free(cpmac_mii);"
>
>Signed-off-by: Dan Carpenter <error27@gmail.com>
>---
>Found by a static checker and not tested.  Sorry.  :/
>
>diff --git a/drivers/net/cpmac.c b/drivers/net/cpmac.c
>index b85c81f..9d48942 100644
>--- a/drivers/net/cpmac.c
>+++ b/drivers/net/cpmac.c
>@@ -1290,8 +1290,8 @@ void __devexit cpmac_exit(void)
> {
> 	platform_driver_unregister(&cpmac_driver);
> 	mdiobus_unregister(cpmac_mii);
>-	mdiobus_free(cpmac_mii);
> 	iounmap(cpmac_mii->priv);
>+	mdiobus_free(cpmac_mii);
> }
> 
> module_init(cpmac_init);

Looks good. Thanks.

Reviewed-by: Jiri Pirko <jpirko@redhat.com>

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
David Miller March 3, 2010, 9:07 a.m. UTC | #2
From: Jiri Pirko <jpirko@redhat.com>
Date: Wed, 3 Mar 2010 09:59:58 +0100

> Wed, Mar 03, 2010 at 09:46:10AM CET, error27@gmail.com wrote:
>>The original code dereferenced "cpmac_mii" after calling 
>>"mdiobus_free(cpmac_mii);"
>>
>>Signed-off-by: Dan Carpenter <error27@gmail.com>
>>---
>>Found by a static checker and not tested.  Sorry.  :/
>>
>>diff --git a/drivers/net/cpmac.c b/drivers/net/cpmac.c
>>index b85c81f..9d48942 100644
>>--- a/drivers/net/cpmac.c
>>+++ b/drivers/net/cpmac.c
>>@@ -1290,8 +1290,8 @@ void __devexit cpmac_exit(void)
>> {
>> 	platform_driver_unregister(&cpmac_driver);
>> 	mdiobus_unregister(cpmac_mii);
>>-	mdiobus_free(cpmac_mii);
>> 	iounmap(cpmac_mii->priv);
>>+	mdiobus_free(cpmac_mii);
>> }
>> 
>> module_init(cpmac_init);
> 
> Looks good. Thanks.
> 
> Reviewed-by: Jiri Pirko <jpirko@redhat.com>

Applied.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

diff --git a/drivers/net/cpmac.c b/drivers/net/cpmac.c
index b85c81f..9d48942 100644
--- a/drivers/net/cpmac.c
+++ b/drivers/net/cpmac.c
@@ -1290,8 +1290,8 @@  void __devexit cpmac_exit(void)
 {
 	platform_driver_unregister(&cpmac_driver);
 	mdiobus_unregister(cpmac_mii);
-	mdiobus_free(cpmac_mii);
 	iounmap(cpmac_mii->priv);
+	mdiobus_free(cpmac_mii);
 }
 
 module_init(cpmac_init);