Unverified Commit e1f872ef authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!15632 macsec: fix UAF bug for real_dev 

Merge Pull Request from: @ci-robot 
 
PR sync from: Wang Liang <wangliang74@huawei.com>
https://mailweb.openeuler.org/archives/list/kernel@openeuler.org/message/5WJ7X6V2FUFFBUD7E7246GLFFMYETLUH/ 
 
https://gitee.com/src-openeuler/kernel/issues/IBP2L3 
 
Link:https://gitee.com/openeuler/kernel/pulls/15632

 

Reviewed-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
Reviewed-by: default avatarYuan Can <yuancan@huawei.com>
Signed-off-by: default avatarYuan Can <yuancan@huawei.com>
parents 0234d659 b139b2e9

drivers/net/macsec.c

+5 −0
Original line number Diff line number Diff line
@@ -2783,6 +2783,9 @@ static int macsec_dev_init(struct net_device *dev) 
	if (is_zero_ether_addr(dev->broadcast))

		memcpy(dev->broadcast, real_dev->broadcast, dev->addr_len);



	/* Get macsec's reference to real_dev */

	dev_hold(real_dev);



	return 0;

}
@@ -3009,6 +3012,8 @@ static void macsec_free_netdev(struct net_device *dev) 
	free_percpu(macsec->stats);

	free_percpu(macsec->secy.tx_sc.stats);



	/* Get rid of the macsec's reference to real_dev */

	dev_put(macsec->real_dev);

}



static void macsec_setup(struct net_device *dev)