Commit 4ba941ef authored by Kaixin Wang's avatar Kaixin Wang Committed by Dong Chenchen
Browse files

net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition 

stable inclusion
from stable-v5.10.227
commit 338a0582b28e69460df03af50e938b86b4206353
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYQS4
CVE: CVE-2024-47747

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=338a0582b28e69460df03af50e938b86b4206353



--------------------------------

[ Upstream commit b5109b60ee4fcb2f2bb24f589575e10cc5283ad4 ]

In the ether3_probe function, a timer is initialized with a callback
function ether3_ledoff, bound to &prev(dev)->timer. Once the timer is
started, there is a risk of a race condition if the module or device
is removed, triggering the ether3_remove function to perform cleanup.
The sequence of operations that may lead to a UAF bug is as follows:

CPU0                                    CPU1

                      |  ether3_ledoff
ether3_remove         |
  free_netdev(dev);   |
  put_devic           |
  kfree(dev);         |
 |  ether3_outw(priv(dev)->regs.config2 |= CFG2_CTRLO, REG_CONFIG2);
                      | // use dev

Fix it by ensuring that the timer is canceled before proceeding with
the cleanup in ether3_remove.

Fixes: 6fd9c53f ("net: seeq: Convert timers to use timer_setup()")
Signed-off-by: default avatarKaixin Wang <kxwang23@m.fudan.edu.cn>
Link: https://patch.msgid.link/20240915144045.451-1-kxwang23@m.fudan.edu.cn


Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarDong Chenchen <dongchenchen2@huawei.com>
parent 81248561

drivers/net/ethernet/seeq/ether3.c

+2 −0
Original line number Diff line number Diff line
@@ -845,9 +845,11 @@ static void ether3_remove(struct expansion_card *ec) 
{

	struct net_device *dev = ecard_get_drvdata(ec);



	ether3_outw(priv(dev)->regs.config2 |= CFG2_CTRLO, REG_CONFIG2);

	ecard_set_drvdata(ec, NULL);



	unregister_netdev(dev);

	del_timer_sync(&priv(dev)->timer);

	free_netdev(dev);

	ecard_release_resources(ec);

}