Commit 6c342ce2 authored by Jeremy Kerr's avatar Jeremy Kerr Committed by Jakub Kicinski
Browse files

mctp: serial: Cancel pending work from ndo_uninit handler 



We cannot do the cancel_work_sync from after the unregister_netdev, as
the dev pointer is no longer valid, causing a uaf on ldisc unregister
(or device close).

Instead, do the cancel_work_sync from the ndo_uninit op, where the dev
still exists, but the queue has stopped.

Fixes: 7bd9890f ("mctp: serial: cancel tx work on ldisc close")
Reported-by: default avatarLuo Likang <luolikang@nsfocus.com>
Tested-by: default avatarLuo Likang <luolikang@nsfocus.com>
Signed-off-by: default avatarJeremy Kerr <jk@codeconstruct.com.au>
Link: https://lore.kernel.org/r/20220211011552.1861886-1-jk@codeconstruct.com.au


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent 6bb9681a

drivers/net/mctp/mctp-serial.c

+8 −1
Original line number Diff line number Diff line
@@ -403,8 +403,16 @@ static void mctp_serial_tty_receive_buf(struct tty_struct *tty, 
		mctp_serial_push(dev, c[i]);

}



static void mctp_serial_uninit(struct net_device *ndev)

{

	struct mctp_serial *dev = netdev_priv(ndev);



	cancel_work_sync(&dev->tx_work);

}



static const struct net_device_ops mctp_serial_netdev_ops = {

	.ndo_start_xmit = mctp_serial_tx,

	.ndo_uninit = mctp_serial_uninit,

};



static void mctp_serial_setup(struct net_device *ndev)
@@ -483,7 +491,6 @@ static void mctp_serial_close(struct tty_struct *tty) 
	int idx = dev->idx;



	unregister_netdev(dev->netdev);

	cancel_work_sync(&dev->tx_work);

	ida_free(&mctp_serial_ida, idx);

}