Messages in this thread | | | Date | Wed, 4 Jan 2012 12:33:11 -0500 | Subject | Re: possible use-after-free in drivers/mtd/ubi/wl.c: erase_worker | From | Josh Boyer <> |
| |
On Tue, Jan 3, 2012 at 6:34 PM, Emese Revfy <re.emese@gmail.com> wrote: > Hi, > > I think I found a potential problem in drivers/mtd/ubi/wl.c in > erase_worker(): > > 1050 ubi_err("failed to erase PEB %d, error %d", pnum, err); > 1051 kfree(wl_wrk); > 1052 kmem_cache_free(ubi_wl_entry_slab, e); > 1053 > 1054 if (err == -EINTR || err == -ENOMEM || err == -EAGAIN || > 1055 err == -EBUSY) { > 1056 int err1; > 1057 > 1058 /* Re-schedule the LEB for erasure */ > 1059 err1 = schedule_erase(ubi, e, 0); > > The pointer e is freed at line 1052 (kmem_cache_free), but > later it is passed to schedule_erase which will eventually call > erase_worker where it will be dereferenced and/or freed again.
Yes. That does seem to be a problem. Care to create a patch that solves this by deferring the frees until after the err variable is checked?
josh -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |