diff options
| author | Carl-Daniel Hailfinger | 2026-01-11 19:31:20 +0000 |
|---|---|---|
| committer | Hauke Mehrtens | 2026-02-08 20:25:29 +0000 |
| commit | dec360a3ac7078046bb789d29244b70776d113e1 (patch) | |
| tree | 7da2cc3889a564bb364d4be1dc22d0a367378b61 | |
| parent | 8c895dc4c5be7c76b200b45818811d5aa4de59bb (diff) | |
| download | openwrt-dec360a3ac7078046bb789d29244b70776d113e1.tar.gz | |
realtek: dsa: avoid use-after-free
The realtek target uses some functions marked __init for initialization.
However, that means they can only be called once when compiled in and
afterwards the memory occupied by them is freed and potentially reused.
Some "impossible" (code at a given location can't crash in the way it
does) crashes can be caused by this because upon re-execution of those
functions, garbage gets executed. Such re-execution can happen for
deferred probes or repeated probes.
Signed-off-by: Carl-Daniel Hailfinger <c-d.hailfinger.devel.2006@gmx.net>
Link: https://github.com/openwrt/openwrt/pull/21504
Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
(cherry picked from commit a91c3abe83c3f9513518c86b5d0a42b5a9afaad3)
Link: https://github.com/openwrt/openwrt/pull/21900
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
| -rw-r--r-- | target/linux/realtek/files-6.12/drivers/net/dsa/rtl83xx/common.c | 6 | ||||
| -rw-r--r-- | target/linux/realtek/files-6.12/drivers/net/ethernet/rtl838x_eth.c | 2 |
2 files changed, 4 insertions, 4 deletions
diff --git a/target/linux/realtek/files-6.12/drivers/net/dsa/rtl83xx/common.c b/target/linux/realtek/files-6.12/drivers/net/dsa/rtl83xx/common.c index 787ceda834..1f0578ebba 100644 --- a/target/linux/realtek/files-6.12/drivers/net/dsa/rtl83xx/common.c +++ b/target/linux/realtek/files-6.12/drivers/net/dsa/rtl83xx/common.c @@ -255,7 +255,7 @@ static int rtldsa_bus_c45_write(struct mii_bus *bus, int addr, int devad, int re return mdiobus_c45_write_nested(priv->parent_bus, addr, devad, regnum, val); } -static int __init rtl83xx_mdio_probe(struct rtl838x_switch_priv *priv) +static int rtl83xx_mdio_probe(struct rtl838x_switch_priv *priv) { struct device_node *dn, *phy_node, *pcs_node, *led_node, *np, *mii_np; struct device *dev = priv->dev; @@ -405,7 +405,7 @@ static int __init rtl83xx_mdio_probe(struct rtl838x_switch_priv *priv) return 0; } -static int __init rtl83xx_get_l2aging(struct rtl838x_switch_priv *priv) +static int rtl83xx_get_l2aging(struct rtl838x_switch_priv *priv) { int t = sw_r32(priv->r->l2_ctrl_1); @@ -1391,7 +1391,7 @@ static int rtldsa_ethernet_loaded(struct platform_device *pdev) return ret; } -static int __init rtl83xx_sw_probe(struct platform_device *pdev) +static int rtl83xx_sw_probe(struct platform_device *pdev) { struct rtl838x_switch_priv *priv; struct device *dev = &pdev->dev; diff --git a/target/linux/realtek/files-6.12/drivers/net/ethernet/rtl838x_eth.c b/target/linux/realtek/files-6.12/drivers/net/ethernet/rtl838x_eth.c index db53496488..c4ffb3173d 100644 --- a/target/linux/realtek/files-6.12/drivers/net/ethernet/rtl838x_eth.c +++ b/target/linux/realtek/files-6.12/drivers/net/ethernet/rtl838x_eth.c @@ -1642,7 +1642,7 @@ static const struct ethtool_ops rtl838x_ethtool_ops = { .set_link_ksettings = rtl838x_set_link_ksettings, }; -static int __init rtl838x_eth_probe(struct platform_device *pdev) +static int rtl838x_eth_probe(struct platform_device *pdev) { struct net_device *dev; struct device_node *dn = pdev->dev.of_node; |