net: fec: memory corruption caused by err_enet_mii_probe error path
flat view
From: Kegl Rohit <hidden>
Date: 2021-12-22 07:06:25
Hello! There is an issue with the error path of fec_enet_mii_probe in fec_enet_open(struct net_device *ndev) which leads to random memory corruption. In open() the buffers are initialized: https://github.com/torvalds/linux/blob/v5.10/drivers/net/ethernet/freescale/fec_main.c#L3001 Then fec_restart will start the DMA engines. https://github.com/torvalds/linux/blob/v5.10/drivers/net/ethernet/freescale/fec_main.c#L3006 Now if fec_enet_mii_probe fails (e.g. phy did not respond via mii) the err_enet_mii_probe error path will be used https://github.com/torvalds/linux/blob/v5.10/drivers/net/ethernet/freescale/fec_main.c#L3031 err_enet_mii_probe: fec_enet_free_buffers(ndev); err_enet_alloc: fec_enet_clk_enable(ndev, false); clk_enable: pm_runtime_mark_last_busy(&fep->pdev->dev); pm_runtime_put_autosuspend(&fep->pdev->dev); pinctrl_pm_select_sleep_state(&fep->pdev->dev); return ret; This error path frees the DMA buffers, BUT as far I could see it does not stop the DMA engines. => open() fails => frees buffers => DMA still active => MAC receives network packet => DMA starts => random memory corruption (use after free) => random kernel panics So maybe fec_stop() as counterpart to fec_restart() is missing before freeing the buffers? err_enet_mii_probe: fec_stop(ndev); fec_enet_free_buffers(ndev); Issue happend with 5.10.83 and should also also happen with current master.