eth: sp7021: fix use after free bug in spl2sw_nvmem_get_mac_address

bluesheep1337 · davem330 · commit 12aece8b0150 · 2022-10-03T12:47:42.000+01:00
This frees "mac" and tries to display its address as part of the error message on the next line. Swap the order. Fixes: fd3040b ("net: ethernet: Add driver for Sunplus SP7021") Signed-off-by: Zheng Wang <zyytlz.wz@163.com> Signed-off-by: David S. Miller <davem@davemloft.net>
diff --git a/drivers/net/ethernet/sunplus/spl2sw_driver.c b/drivers/net/ethernet/sunplus/spl2sw_driver.c
@@ -248,8 +248,8 @@ static int spl2sw_nvmem_get_mac_address(struct device *dev, struct device_node *
 
 	/* Check if mac address is valid */
 	if (!is_valid_ether_addr(mac)) {
-		kfree(mac);
 		dev_info(dev, "Invalid mac address in nvmem (%pM)!\n", mac);
+		kfree(mac);
 		return -EINVAL;
 	}
 

Original file line number	Diff line number	Diff line change
`@@ -248,8 +248,8 @@ static int spl2sw_nvmem_get_mac_address(struct device dev, struct device_node `
`248`	`248`
`249`	`249`	`/* Check if mac address is valid */`
`250`	`250`	`if (!is_valid_ether_addr(mac)) {`
`251`		`- kfree(mac);`
`252`	`251`	`dev_info(dev, "Invalid mac address in nvmem (%pM)!\n", mac);`
	`252`	`+ kfree(mac);`
`253`	`253`	`return -EINVAL;`
`254`	`254`	`}`
`255`	`255`