xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
c36d41b65e57cc524adb200c0670978cb54c1dec
android_kernel_xiaomi_sm8450/drivers/net/ethernet
History
Tong Zhang b8def021ac epic100: fix use after free on rmmod 
commit 8ee9d82cd0a45e7d050ade598c9f33032a0f2891 upstream.

epic_close() calls epic_rx() and uses dma buffer, but in epic_remove_one()
we already freed the dma buffer. To fix this issue, reorder function calls
like in the .probe function.

BUG: KASAN: use-after-free in epic_rx+0xa6/0x7e0 [epic100]
Call Trace:
 epic_rx+0xa6/0x7e0 [epic100]
 epic_close+0xec/0x2f0 [epic100]
 unregister_netdev+0x18/0x20
 epic_remove_one+0xaa/0xf0 [epic100]

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Reported-by: Yilun Wu <yiluwu@cs.stonybrook.edu>
Signed-off-by: Tong Zhang <ztong0001@gmail.com>
Reviewed-by: Francois Romieu <romieu@fr.zoreil.com>
Link: https://lore.kernel.org/r/20220627043351.25615-1-ztong0001@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-07-07 17:52:19 +02:00
..
3com
…
8390
net:mcf8390: Use platform_get_irq() to get the interrupt
2022-04-08 14:39:48 +02:00
adaptec
…
aeroflex
net: ethernet: aeroflex: fix UAF in greth_of_remove
2021-07-14 16:56:24 +02:00
agere
…
alacritech
…
allwinner
…
alteon
…
altera
net: altera: Fix refcount leak in altera_tse_mdio_create
2022-06-14 18:32:41 +02:00
amazon
net: ena: Fix error handling when calculating max IO queues number
2022-01-11 15:25:01 +01:00
amd
net: amd-xgbe: disable interrupts during pci removal
2022-02-16 12:54:26 +01:00
apm
drivers: net: xgene: Fix regression in CRC stripping
2022-03-28 09:57:09 +02:00
apple
…
aquantia
net: atlantic: verify hw_head_ lies within TX buffer ring
2022-05-25 09:18:01 +02:00
arc
net: arc: select CRC32
2021-10-20 11:45:03 +02:00
atheros
net: ag71xx: Fix a potential double free in error handling paths
2022-01-05 12:40:31 +01:00
aurora
…
broadcom
net: bgmac: Fix an erroneous kfree() in bgmac_remove()
2022-06-22 14:13:17 +02:00
brocade
…
cadence
net: macb: Increment rx bd head after allocating skb and buffer
2022-05-25 09:17:57 +02:00
calxeda
…
cavium
cavium: Fix return values of the probe function
2021-11-18 14:03:41 +01:00
chelsio
lsm,selinux: pass flowi_common instead of flowi to the LSM hooks
2022-06-09 10:21:09 +02:00
cirrus
…
cisco
…
cortina
net: gemini: allow any RGMII interface mode
2022-01-27 10:54:20 +01:00
davicom
…
dec
ethernet: tulip: fix missing pci_disable_device() on error in tulip_init_one()
2022-05-25 09:18:00 +02:00
dlink
…
emulex
Revert "be2net: disable bh with spin_lock in be_process_mcc"
2021-07-14 16:56:29 +02:00
ezchip
net: ethernet: ezchip: fix error handling
2021-07-14 16:56:24 +02:00
faraday
net: ftgmac100: Disable hardware checksum on AST2600
2022-06-06 08:42:40 +02:00
freescale
net: fec: add missing of_node_put() in fec_enet_init_stop_mode()
2022-05-09 09:05:05 +02:00
fujitsu
…
google
gve: fix the wrong AdminQ buffer queue index check
2022-02-08 18:30:39 +01:00
hisilicon
net: hns3: add return value for mailbox handling in PF
2022-05-09 09:05:04 +02:00
huawei
hinic: Avoid some over memory allocation
2022-06-09 10:21:12 +02:00
i825xx
lib82596: Fix IRQ check in sni_82596_probe
2022-01-27 10:54:36 +01:00
ibm
Revert "ibmvnic: Add ethtool private flag for driver-defined queue limits"
2022-05-09 09:05:06 +02:00
intel
igb: Make DMA faster when CPU is active on the PCIe link
2022-06-29 08:59:49 +02:00
marvell
octeontx2-pf: Forward error codes to VF
2022-02-01 17:25:45 +01:00
mediatek
net: ethernet: mtk_eth_soc: fix misuse of mem alloc interface netdev[napi]_alloc_frag
2022-06-22 14:13:15 +02:00
mellanox
mlxsw: spectrum_cnt: Reorder counter pools
2022-06-22 14:13:17 +02:00
micrel
Revert "net: micrel: fix KS8851_MLL Kconfig"
2022-04-27 13:53:58 +02:00
microchip
lan743x: fix deadlock in lan743x_phy_link_status_change()
2021-12-01 09:19:06 +01:00
moxa
net: moxa: fix UAF in moxart_mac_probe
2021-07-25 14:36:19 +02:00
mscc
net: mscc: ocelot: allow unregistered IP multicast flooding
2022-07-02 16:39:25 +02:00
myricom
myri10ge: fix an incorrect free for skb in myri10ge_sw_tso
2022-04-20 09:23:23 +02:00
natsemi
natsemi: xtensa: fix section mismatch warnings
2021-12-08 09:03:23 +01:00
neterion
ethernet: s2io: fix setting mac address during resume
2021-10-20 11:45:04 +02:00
netronome
nfp: only report pause frame configuration for physical device
2022-06-14 18:32:36 +02:00
ni
…
nvidia
…
nxp
net: ethernet: lpc_eth: Handle error for clk_enable
2022-03-16 14:15:58 +01:00
oki-semi
net: pch_gbe: Use proper accessors to BE data in pch_ptp_match()
2021-07-19 09:44:37 +02:00
packetengines
…
pasemi
…
pensando
ionic: fix missing pci_release_regions() on error in ionic_probe()
2022-05-18 10:23:43 +02:00
qlogic
net/qla3xxx: Fix a test in ql_reset_work()
2022-05-25 09:17:58 +02:00
qualcomm
net: qualcomm: fix QCA7000 checksum handling
2021-09-15 09:50:46 +02:00
rdc
r6040: Restore MDIO clock frequency after MAC reset
2021-09-22 12:27:57 +02:00
realtek
r8169: Add device 10ec:8162 to driver r8169
2021-11-18 14:03:43 +01:00
renesas
net: renesas: sh_eth: Fix freeing wrong tx descriptor
2021-09-22 12:28:06 +02:00
rocker
rocker: fix a sleeping in atomic bug
2022-01-27 10:54:01 +01:00
samsung
net: sxgbe: fix return value of __setup handler
2022-03-08 19:09:35 +01:00
seeq
…
sfc
sfc: fix wrong tx channel offset with efx_separate_tx_channels
2022-06-14 18:32:36 +02:00
sgi
net: sgi: ioc3-eth: check return value after calling platform_get_resource()
2021-07-19 09:44:49 +02:00
silan
…
sis
sis900: Fix missing pci_disable_device() in probe and remove
2021-08-04 12:46:44 +02:00
smsc
epic100: fix use after free on rmmod
2022-07-07 17:52:19 +02:00
socionext
…
stmicro
net: stmmac: fix out-of-bounds access in a selftest
2022-06-09 10:21:11 +02:00
sun
ethernet: sun: Free the coherent when failing in probing
2022-04-08 14:39:47 +02:00
synopsys
…
tehuti
…
ti
net: ethernet: ti: am65-cpsw-nuss: Fix some refcount leaks
2022-06-14 18:32:35 +02:00
toshiba
…
tundra
…
via
…
wiznet
net: w5100: check return value after calling platform_get_resource()
2021-09-18 13:40:35 +02:00
xilinx
net: emaclite: Don't advertise 1000BASE-T and do auto negotiation
2022-05-18 10:23:45 +02:00
xircom
…
xscale
…
dnet.c
…
dnet.h
…
ec_bhf.c
…
ethoc.c
…
fealnx.c
…
jme.c
…
jme.h
…
Kconfig
net: korina: select CRC32
2021-10-20 11:45:03 +02:00
korina.c
…
lantiq_etop.c
…
lantiq_xrx200.c
net: lantiq_xrx200: fix statistics of received bytes
2022-01-05 12:40:31 +01:00
Makefile
…