net: dsa: lantiq_gswip: fix use after free in gswip_remove()

khoroshilov · kuba-moo · commit 8c6ae46150a4 · 2022-02-16T20:39:13.000-08:00
of_node_put(priv->ds->slave_mii_bus->dev.of_node) should be done before mdiobus_free(priv->ds->slave_mii_bus). Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru> Fixes: 0d120df ("net: dsa: lantiq_gswip: don't use devres for mdiobus") Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://lore.kernel.org/r/1644921768-26477-1-git-send-email-khoroshilov@ispras.ru Signed-off-by: Jakub Kicinski <kuba@kernel.org>
diff --git a/drivers/net/dsa/lantiq_gswip.c b/drivers/net/dsa/lantiq_gswip.c
@@ -2176,8 +2176,8 @@ static int gswip_remove(struct platform_device *pdev)
 
 	if (priv->ds->slave_mii_bus) {
 		mdiobus_unregister(priv->ds->slave_mii_bus);
-		mdiobus_free(priv->ds->slave_mii_bus);
 		of_node_put(priv->ds->slave_mii_bus->dev.of_node);
+		mdiobus_free(priv->ds->slave_mii_bus);
 	}
 
 	for (i = 0; i < priv->num_gphy_fw; i++)

Original file line number	Diff line number	Diff line change
`@@ -2176,8 +2176,8 @@ static int gswip_remove(struct platform_device *pdev)`
`2176`	`2176`
`2177`	`2177`	`if (priv->ds->slave_mii_bus) {`
`2178`	`2178`	`mdiobus_unregister(priv->ds->slave_mii_bus);`
`2179`		`- mdiobus_free(priv->ds->slave_mii_bus);`
`2180`	`2179`	`of_node_put(priv->ds->slave_mii_bus->dev.of_node);`
	`2180`	`+ mdiobus_free(priv->ds->slave_mii_bus);`
`2181`	`2181`	`}`
`2182`	`2182`
`2183`	`2183`	`for (i = 0; i < priv->num_gphy_fw; i++)`