]> git.baikalelectronics.ru Git - kernel.git/commit
can: c_can_pci: c_can_pci_remove(): fix use-after-free
authorTong Zhang <ztong0001@gmail.com>
Mon, 1 Mar 2021 02:45:11 +0000 (21:45 -0500)
committerMarc Kleine-Budde <mkl@pengutronix.de>
Tue, 16 Mar 2021 07:41:27 +0000 (08:41 +0100)
commitc649a81607c947e49e2f9254f17334bd7ab0d790
treea9eca01ded1810a2165a1cee06fb359711c58b2b
parent49dc74bf023b4e59288c72afbd129823c2078d0a
can: c_can_pci: c_can_pci_remove(): fix use-after-free

There is a UAF in c_can_pci_remove(). dev is released by
free_c_can_dev() and is used by pci_iounmap(pdev, priv->base) later.
To fix this issue, save the mmio address before releasing dev.

Fixes: d2cfc30675ba ("c_can_pci: generic module for C_CAN/D_CAN on PCI")
Link: https://lore.kernel.org/r/20210301024512.539039-1-ztong0001@gmail.com
Signed-off-by: Tong Zhang <ztong0001@gmail.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
drivers/net/can/c_can/c_can_pci.c