Messages in this thread | | | Subject | Re: [PATCH -next] mtd/ftl: Fix uaf in ftl_remove_dev() | From | cuigaosheng <> | Date | Thu, 18 Aug 2022 09:32:13 +0800 |
| |
PING
在 2022/7/15 15:11, Gaosheng Cui 写道: > del_mtd_blktrans_dev will reclaim the resources of mtd_blktrans_dev, > and call kfree(dev) in blktrans_dev_put to release the memory of > mtd_blktrans_dev, so when ftl_freepart reclaims the memory of other > member pointers of the partition_t, it will trigger the uaf problem, > Fix it by moving ftl_freepart in front of del_mtd_blktrans_dev. > > Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") > Signed-off-by: Gaosheng Cui <cuigaosheng1@huawei.com> > --- > drivers/mtd/ftl.c | 6 +++++- > 1 file changed, 5 insertions(+), 1 deletion(-) > > diff --git a/drivers/mtd/ftl.c b/drivers/mtd/ftl.c > index 200271bdc7aa..bec56070039d 100644 > --- a/drivers/mtd/ftl.c > +++ b/drivers/mtd/ftl.c > @@ -1039,8 +1039,12 @@ static void ftl_add_mtd(struct mtd_blktrans_ops *tr, struct mtd_info *mtd) > > static void ftl_remove_dev(struct mtd_blktrans_dev *dev) > { > + struct partition_t *partition; > + > + partition = container_of(dev, struct partition_t, mbd); > + > + ftl_freepart(partition); > del_mtd_blktrans_dev(dev); > - ftl_freepart((partition_t *)dev); > } > > static struct mtd_blktrans_ops ftl_tr = {
| |