* [PATCH 4.14 253/343] net: pasemi: fix an use-after-free in pasemi_mac_phy_init()
[not found] <20200124092919.490687572@linuxfoundation.org>
@ 2020-01-24 9:31 ` Greg Kroah-Hartman
0 siblings, 0 replies; only message in thread
From: Greg Kroah-Hartman @ 2020-01-24 9:31 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Wen Yang, David S. Miller,
Thomas Gleixner, Luis Chamberlain, Michael Ellerman, netdev,
Sasha Levin
From: Wen Yang <wen.yang99@zte•com.cn>
[ Upstream commit faf5577f2498cea23011b5c785ef853ded22700b ]
The phy_dn variable is still being used in of_phy_connect() after the
of_node_put() call, which may result in use-after-free.
Fixes: 1dd2d06c0459 ("net: Rework pasemi_mac driver to use of_mdio infrastructure")
Signed-off-by: Wen Yang <wen.yang99@zte•com.cn>
Cc: "David S. Miller" <davem@davemloft•net>
Cc: Thomas Gleixner <tglx@linutronix•de>
Cc: Luis Chamberlain <mcgrof@kernel•org>
Cc: Michael Ellerman <mpe@ellerman•id.au>
Cc: netdev@vger•kernel.org
Cc: linux-kernel@vger•kernel.org
Signed-off-by: David S. Miller <davem@davemloft•net>
Signed-off-by: Sasha Levin <sashal@kernel•org>
---
drivers/net/ethernet/pasemi/pasemi_mac.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/pasemi/pasemi_mac.c b/drivers/net/ethernet/pasemi/pasemi_mac.c
index 49591d9c2e1b9..c9b4ac9d3330a 100644
--- a/drivers/net/ethernet/pasemi/pasemi_mac.c
+++ b/drivers/net/ethernet/pasemi/pasemi_mac.c
@@ -1053,7 +1053,6 @@ static int pasemi_mac_phy_init(struct net_device *dev)
dn = pci_device_to_OF_node(mac->pdev);
phy_dn = of_parse_phandle(dn, "phy-handle", 0);
- of_node_put(phy_dn);
mac->link = 0;
mac->speed = 0;
@@ -1062,6 +1061,7 @@ static int pasemi_mac_phy_init(struct net_device *dev)
phydev = of_phy_connect(dev, phy_dn, &pasemi_adjust_link, 0,
PHY_INTERFACE_MODE_SGMII);
+ of_node_put(phy_dn);
if (!phydev) {
printk(KERN_ERR "%s: Could not attach to phy\n", dev->name);
return -ENODEV;
--
2.20.1
^ permalink raw reply related [flat|nested] only message in thread