summaryrefslogtreecommitdiff
path: root/drivers/net/hamradio
diff options
context:
space:
mode:
authorLin Ma <linma@zju.edu.cn>2021-11-11 17:14:02 +0300
committerJakub Kicinski <kuba@kernel.org>2021-11-13 06:56:47 +0300
commit81b1d548d00bcd028303c4f3150fa753b9b8aa71 (patch)
tree3fa494df2325fcbdf209faa46ced6bcb33853dba /drivers/net/hamradio
parent66f4beaa6c1d28161f534471484b2daa2de1dce0 (diff)
downloadlinux-81b1d548d00bcd028303c4f3150fa753b9b8aa71.tar.xz
hamradio: remove needs_free_netdev to avoid UAF
The former patch "defer 6pack kfree after unregister_netdev" reorders the kfree of two buffer after the unregister_netdev to prevent the race condition. It also adds free_netdev() function in sixpack_close(), which is a direct copy from the similar code in mkiss_close(). However, in sixpack driver, the flag needs_free_netdev is set to true in sp_setup(), hence the unregister_netdev() will free the netdev automatically. Therefore, as the sp is netdev_priv, use-after-free occurs. This patch removes the needs_free_netdev = true and just let the free_netdev to finish this deallocation task. Fixes: 0b9111922b1f ("hamradio: defer 6pack kfree after unregister_netdev") Signed-off-by: Lin Ma <linma@zju.edu.cn> Link: https://lore.kernel.org/r/20211111141402.7551-1-linma@zju.edu.cn Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'drivers/net/hamradio')
-rw-r--r--drivers/net/hamradio/6pack.c1
1 files changed, 0 insertions, 1 deletions
diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c
index bfdf89e54752..8a19a06b505d 100644
--- a/drivers/net/hamradio/6pack.c
+++ b/drivers/net/hamradio/6pack.c
@@ -306,7 +306,6 @@ static void sp_setup(struct net_device *dev)
{
/* Finish setting up the DEVICE info. */
dev->netdev_ops = &sp_netdev_ops;
- dev->needs_free_netdev = true;
dev->mtu = SIXP_MTU;
dev->hard_header_len = AX25_MAX_HEADER_LEN;
dev->header_ops = &ax25_header_ops;