[PATCH net] net: enc28j60: cancel deferred works on remove to avoid use-after-free

[hyunjungg <hj351016@gmail.com>]

From: Hyunjung Ko <hj351016@gmail.com>

enc28j60 defers work to three work_structs that dereference the driver
private data via container_of(): tx_work (queued from ndo_start_xmit),
setrx_work (from ndo_set_rx_mode) and restart_work (from ndo_tx_timeout).
They run on the system workqueue and are never cancelled.

enc28j60_remove() calls unregister_netdev(), then free_irq(), then
free_netdev(). unregister_netdev() brings the interface down so no new
work is scheduled, but it does not cancel a work that was already queued
from an xmit, rx-mode change or TX timeout shortly before the device went
down. priv is netdev_priv() memory and is freed by free_netdev(), so a
still-pending work then runs enc28j60_tx_work_handler() /
enc28j60_setrx_work_handler() / enc28j60_restart_work_handler() against
freed memory (use-after-free).

Cancel the three works after unregister_netdev() (which guarantees no new
scheduling) and before free_netdev(), while priv is still valid. The
handlers do not re-queue themselves or each other, so cancelling each once
is sufficient.

Found by static analysis and code review; not tested on real hardware
(needs an ENC28J60 SPI Ethernet device).

Fixes: 3ec9c11da033 ("add driver for enc28j60 ethernet chip")
Cc: stable@vger.kernel.org
Signed-off-by: Hyunjung Ko <hj351016@gmail.com>
---
 drivers/net/ethernet/microchip/enc28j60.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/ethernet/microchip/enc28j60.c b/drivers/net/ethernet/microchip/enc28j60.c
index d6c9491..5266912 100644
--- a/drivers/net/ethernet/microchip/enc28j60.c
+++ b/drivers/net/ethernet/microchip/enc28j60.c
@@ -1602,6 +1602,9 @@ static void enc28j60_remove(struct spi_device *spi)
 
 	unregister_netdev(priv->netdev);
 	free_irq(spi->irq, priv);
+	cancel_work_sync(&priv->tx_work);
+	cancel_work_sync(&priv->setrx_work);
+	cancel_work_sync(&priv->restart_work);
 	free_netdev(priv->netdev);
 }
 
-- 
2.43.0