Re: [PATCH v4] net: ravb: Fix possible UAF bug in ravb_remove
From: Zheng Hacker <hidden>
Date: 2023-08-30 04:31:12
Also in:
linux-renesas-soc, lkml
From: Zheng Hacker <hidden>
Date: 2023-08-30 04:31:12
Also in:
linux-renesas-soc, lkml
Sorry for my late reply. I'll update another patch later today. Best regards, Zheng Lee Jones [off-list ref] 于2023年8月29日周二 21:46写道:
On Tue, 15 Aug 2023, Lee Jones wrote:quoted
On Tue, 25 Jul 2023, Zheng Wang wrote:quoted
In ravb_probe, priv->work was bound with ravb_tx_timeout_work. If timeout occurs, it will start the work. And if we call ravb_remove without finishing the work, there may be a use-after-free bug on ndev. Fix it by finishing the job before cleanup in ravb_remove. Note that this bug is found by static analysis, it might be false positive. Fixes: c156633f1353 ("Renesas Ethernet AVB driver proper") Signed-off-by: Zheng Wang <redacted> Reviewed-by: Sergey Shtylyov <redacted> --- v4: - add information about the bug was found suggested by Yunsheng Lin v3: - fix typo in commit message v2: - stop dev_watchdog so that handle no more timeout work suggested by Yunsheng Lin, add an empty line to make code clear suggested by Sergey Shtylyov --- drivers/net/ethernet/renesas/ravb_main.c | 3 +++ 1 file changed, 3 insertions(+)Trying my best not to sound like a broken record, but ... What's the latest with this fix? Is a v5 en route?Any update please Zheng Wang? -- Lee Jones [李琼斯]