peak_pci_probe() initializes the PCIeC resources before registering the SJA1000 network device. On the probe error path, the registered channels are freed with free_sja1000dev() before peak_pciec_remove() is called. Since chan is part of the netdev private data, accessing chan->pciec_card after free_sja1000dev() results in a use-after-free. There is also a similar cleanup issue when peak_pciec_probe() succeeds for the first channel but register_sja1000dev() subsequently fails. In that case, the netdev is freed without releasing the PCIeC resources. Clean up the PCIeC resources before freeing the first channel, matching the ordering used by peak_pci_remove(), and also release them when registration of the first channel fails. This issue was found by manual code inspection. Fixes: e6d9c80b7ca1 ("can: peak_pci: add support of some new PEAK-System PCI cards") Cc: stable@vger.kernel.org Signed-off-by: Guangshuo Li --- drivers/net/can/sja1000/peak_pci.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/drivers/net/can/sja1000/peak_pci.c b/drivers/net/can/sja1000/peak_pci.c index 69c61ccf621d..28b94e642170 100644 --- a/drivers/net/can/sja1000/peak_pci.c +++ b/drivers/net/can/sja1000/peak_pci.c @@ -697,6 +697,8 @@ static int peak_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent) return 0; failure_free_dev: +if (!chan->prev_dev && chan->pciec_card) + peak_pciec_remove(chan->pciec_card); pci_set_drvdata(pdev, chan->prev_dev); free_sja1000dev(dev); @@ -704,20 +706,18 @@ static int peak_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent) /* Disable interrupts */ writew(0x0, cfg_base + PITA_ICR + 2); - chan = NULL; for (dev = pci_get_drvdata(pdev); dev; dev = prev_dev) { priv = netdev_priv(dev); chan = priv->priv; prev_dev = chan->prev_dev; + /* do that only for first channel */ + if (!prev_dev && chan->pciec_card) + peak_pciec_remove(chan->pciec_card); unregister_sja1000dev(dev); free_sja1000dev(dev); } - /* free any PCIeC resources too */ - if (chan && chan->pciec_card) - peak_pciec_remove(chan->pciec_card); - pci_iounmap(pdev, reg_base); failure_unmap_cfg_base: -- 2.43.0