[PATCH] eth: sp7021: fix use after free bug in spl2sw_nvmem_get_mac_address

Zheng Wang posted 1 patch 3 years, 6 months ago
There is a newer version of this series
drivers/net/ethernet/sunplus/spl2sw_driver.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
[PATCH] eth: sp7021: fix use after free bug in spl2sw_nvmem_get_mac_address
Posted by Zheng Wang 3 years, 6 months ago
This frees "mac" and tries to display its address as part of the error
message on the next line.  Swap the order.

Fixes: fd3040b9394c ("net: ethernet: Add driver for Sunplus SP7021")

Reported-by: Zheng Wang <hackerzheng666@gmail.com>

Signed-off-by: Zheng Wang <zyytlz.wz@163.com>
---
 drivers/net/ethernet/sunplus/spl2sw_driver.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/sunplus/spl2sw_driver.c b/drivers/net/ethernet/sunplus/spl2sw_driver.c
index 546206640492..61d1d07dc070 100644
--- a/drivers/net/ethernet/sunplus/spl2sw_driver.c
+++ b/drivers/net/ethernet/sunplus/spl2sw_driver.c
@@ -248,8 +248,8 @@ static int spl2sw_nvmem_get_mac_address(struct device *dev, struct device_node *
 
 	/* Check if mac address is valid */
 	if (!is_valid_ether_addr(mac)) {
-		kfree(mac);
 		dev_info(dev, "Invalid mac address in nvmem (%pM)!\n", mac);
+		kfree(mac);
 		return -EINVAL;
 	}
 
-- 
2.25.1
Re: [PATCH] eth: sp7021: fix use after free bug in spl2sw_nvmem_get_mac_address
Posted by Jakub Kicinski 3 years, 6 months ago
On Fri, 30 Sep 2022 12:03:10 +0800 Zheng Wang wrote:
> This frees "mac" and tries to display its address as part of the error
> message on the next line.  Swap the order.
> 
> Fixes: fd3040b9394c ("net: ethernet: Add driver for Sunplus SP7021")
> 
> Reported-by: Zheng Wang <hackerzheng666@gmail.com>
> 
> Signed-off-by: Zheng Wang <zyytlz.wz@163.com>

Is there reporter and author the same person with different email
addresses or two people?
Re: [PATCH] eth: sp7021: fix use after free bug in spl2sw_nvmem_get_mac_address
Posted by Zheng Hacker 3 years, 6 months ago
> Is there reporter and author the same person with different email
> addresses or two people?
>

Hi Jakub,
Yes, its the same person from different email count.

Regards,
Zheng Wang
Re: [PATCH] eth: sp7021: fix use after free bug in spl2sw_nvmem_get_mac_address
Posted by Jakub Kicinski 3 years, 6 months ago
On Sat, 1 Oct 2022 01:23:52 +0800 Zheng Hacker wrote:
> > Is there reporter and author the same person with different email
> > addresses or two people?
> >  
> 
> Hi Jakub,
> Yes, its the same person from different email count.

Please repost without the Reported-by tag, then.
It's implied that you found the problem yourself
if there is no Reported-by tag.

Please remove the empty line between the Fixes
tag and you Signed-off-by tag.
Re: [PATCH] eth: sp7021: fix use after free bug in spl2sw_nvmem_get_mac_address
Posted by Zheng Hacker 3 years, 6 months ago
> Please repost without the Reported-by tag, then.
> It's implied that you found the problem yourself
> if there is no Reported-by tag.
>
> Please remove the empty line between the Fixes
> tag and you Signed-off-by tag.

Hi Jakub,

I'll fix that and resend the patch right away. Thanks for your advice :)

Regards,
Zheng Wang