Unverified Commit 7af62ccc authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!3594 CVE-2023-35827 patchset 

Merge Pull Request from: @ci-robot 
 
PR sync from: Ziyang Xuan <william.xuanziyang@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/BABSIWJCGKPHDZ73J5QESQBCD3GTDAY5/ 
CVE-2023-35827 patchset.

Yoshihiro Shimoda (2):
  ravb: Fix use-after-free issue in ravb_tx_timeout_work()
  ravb: Fix races between ravb_tx_timeout_work() and net related ops


-- 
2.25.1
 
https://gitee.com/src-openeuler/kernel/issues/I7EDZ1 
 
Link:https://gitee.com/openeuler/kernel/pulls/3594

 

Reviewed-by: default avatarYue Haibing <yuehaibing@huawei.com>
Signed-off-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
parents d2dbfe81 9542c73a

drivers/net/ethernet/renesas/ravb_main.c

+12 −1
Original line number Diff line number Diff line
@@ -1442,6 +1442,12 @@ static void ravb_tx_timeout_work(struct work_struct *work) 
	struct net_device *ndev = priv->ndev;

	int error;



	if (!rtnl_trylock()) {

		usleep_range(1000, 2000);

		schedule_work(&priv->work);

		return;

	}



	netif_tx_stop_all_queues(ndev);



	/* Stop PTP Clock driver */
@@ -1474,7 +1480,7 @@ static void ravb_tx_timeout_work(struct work_struct *work) 
		 */

		netdev_err(ndev, "%s: ravb_dmac_init() failed, error %d\n",

			   __func__, error);

		return;

		goto out_unlock;

	}

	ravb_emac_init(ndev);
@@ -1484,6 +1490,9 @@ static void ravb_tx_timeout_work(struct work_struct *work) 
		ravb_ptp_init(ndev, priv->pdev);



	netif_tx_start_all_queues(ndev);



out_unlock:

	rtnl_unlock();

}



/* Packet transmit function for Ethernet AVB */
@@ -1710,6 +1719,8 @@ static int ravb_close(struct net_device *ndev) 
			of_phy_deregister_fixed_link(np);

	}



	cancel_work_sync(&priv->work);



	if (priv->chip_id != RCAR_GEN2) {

		free_irq(priv->tx_irqs[RAVB_NC], ndev);

		free_irq(priv->rx_irqs[RAVB_NC], ndev);