epic100: fix use after free on rmmod
epic_close() calls epic_rx() and uses dma buffer, but in epic_remove_one() we already freed the dma buffer. To fix this issue, reorder function calls like in the .probe function. BUG: KASAN: use-after-free in epic_rx+0xa6/0x7e0 [epic100] Call Trace: epic_rx+0xa6/0x7e0 [epic100] epic_close+0xec/0x2f0 [epic100] unregister_netdev+0x18/0x20 epic_remove_one+0xaa/0xf0 [epic100] Fixes: 1da177e4 ("Linux-2.6.12-rc2") Reported-by:Yilun Wu <yiluwu@cs.stonybrook.edu> Signed-off-by:
Tong Zhang <ztong0001@gmail.com> Reviewed-by:
Francois Romieu <romieu@fr.zoreil.com> Link: https://lore.kernel.org/r/20220627043351.25615-1-ztong0001@gmail.com Signed-off-by:
Jakub Kicinski <kuba@kernel.org>
parent
a8fc8cb5