lkml.org 
[lkml]   [2022]   [Jun]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.4 328/411] ubi: ubi_create_volume: Fix use-after-free when volume creation failed
    Date
    From: Zhihao Cheng <chengzhihao1@huawei.com>

    [ Upstream commit 8c03a1c21d72210f81cb369cc528e3fde4b45411 ]

    There is an use-after-free problem for 'eba_tbl' in ubi_create_volume()'s
    error handling path:

    ubi_eba_replace_table(vol, eba_tbl)
    vol->eba_tbl = tbl
    out_mapping:
    ubi_eba_destroy_table(eba_tbl) // Free 'eba_tbl'
    out_unlock:
    put_device(&vol->dev)
    vol_release
    kfree(tbl->entries) // UAF

    Fix it by removing redundant 'eba_tbl' releasing.
    Fetch a reproducer in [Link].

    Fixes: 493cfaeaa0c9b ("mtd: utilize new cdev_device_add helper function")
    Link: https://bugzilla.kernel.org/show_bug.cgi?id=215965
    Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
    Signed-off-by: Richard Weinberger <richard@nod.at>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/mtd/ubi/vmt.c | 1 -
    1 file changed, 1 deletion(-)

    diff --git a/drivers/mtd/ubi/vmt.c b/drivers/mtd/ubi/vmt.c
    index 1bc7b3a05604..6ea95ade4ca6 100644
    --- a/drivers/mtd/ubi/vmt.c
    +++ b/drivers/mtd/ubi/vmt.c
    @@ -309,7 +309,6 @@ int ubi_create_volume(struct ubi_device *ubi, struct ubi_mkvol_req *req)
    ubi->volumes[vol_id] = NULL;
    ubi->vol_count -= 1;
    spin_unlock(&ubi->volumes_lock);
    - ubi_eba_destroy_table(eba_tbl);
    out_acc:
    spin_lock(&ubi->volumes_lock);
    ubi->rsvd_pebs -= vol->reserved_pebs;
    --
    2.35.1


    \
     
     \ /
      Last update: 2022-06-13 13:41    [W:4.226 / U:0.240 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site