Messages in this thread | | | Date | Thu, 27 Jul 2023 17:20:13 +0200 | From | Miquel Raynal <> | Subject | Re: [PATCH] mtd: fix use-after-free in mtd release |
| |
Hi Andy,
andriy.shevchenko@linux.intel.com wrote on Thu, 27 Jul 2023 18:12:04 +0300:
> On Thu, Jul 27, 2023 at 05:57:58PM +0300, Alexander Usyskin wrote: > > I case of partition device_unregister in mtd_device_release > > In > > device_unregister() > mtd_device_release() > > > calls mtd_release which frees mtd_info structure for partition. > > mtd_release() > > > All code after device_unregister in mtd_device_release thus > > device_unregister() > mtd_device_release() > > > works already freed memory. > > uses? > > > Move part of code to mtd_release and restict mtd->dev cleanup > > mtd_release()
Yup, thanks for all these suggestions, I agree with them.
> > to non-partion object. > > For partition object such cleanup have no sense as partition > > mtd_info is removed. > > > > Cc: Miquel Raynal <miquel.raynal@bootlin.com> > > Cc: Zhang Xiaoxu <zhangxiaoxu5@huawei.com> > > Fixes: 19bfa9ebebb5 ("mtd: use refcount to prevent corruption") > > Closes: ?
Did I miss a recent update on the use of Fixes? I thought Closes was supposed to point at a bug report while Fixes would point to the faulty commit. Right now I feel like Fixes is the right tag, but if you have a source explaining why we should not longer do it like I am used to, I would appreciate a link.
Thanks, Miquèl
| |