Messages in this thread Patch in this message | | | From | Gaosheng Cui <> | Subject | [PATCH -next] mtd/ftl: Fix uaf in ftl_remove_dev() | Date | Fri, 15 Jul 2022 15:11:19 +0800 |
| |
del_mtd_blktrans_dev will reclaim the resources of mtd_blktrans_dev, and call kfree(dev) in blktrans_dev_put to release the memory of mtd_blktrans_dev, so when ftl_freepart reclaims the memory of other member pointers of the partition_t, it will trigger the uaf problem, Fix it by moving ftl_freepart in front of del_mtd_blktrans_dev.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Gaosheng Cui <cuigaosheng1@huawei.com> --- drivers/mtd/ftl.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/mtd/ftl.c b/drivers/mtd/ftl.c index 200271bdc7aa..bec56070039d 100644 --- a/drivers/mtd/ftl.c +++ b/drivers/mtd/ftl.c @@ -1039,8 +1039,12 @@ static void ftl_add_mtd(struct mtd_blktrans_ops *tr, struct mtd_info *mtd) static void ftl_remove_dev(struct mtd_blktrans_dev *dev) { + struct partition_t *partition; + + partition = container_of(dev, struct partition_t, mbd); + + ftl_freepart(partition); del_mtd_blktrans_dev(dev); - ftl_freepart((partition_t *)dev); } static struct mtd_blktrans_ops ftl_tr = { -- 2.25.1
| |