lkml.org 
[lkml]   [2023]   [Aug]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: [PATCH v2] mtd: fix use-after-free in mtd release
Date
On Mon, 2023-07-31 at 11:58:36 UTC, Alexander Usyskin wrote:
> I case of partition device_unregister() in mtd_device_release()
> calls mtd_release() which frees mtd_info structure for partition.
> All code after device_unregister in mtd_device_release thus
> uses already freed memory.
>
> Move part of code to mtd_release() and restict mtd->dev cleanup
> to non-partion object.
> For partition object such cleanup have no sense as partition
> mtd_info is removed.
>
> Cc: Miquel Raynal <miquel.raynal@bootlin.com>
> Cc: Zhang Xiaoxu <zhangxiaoxu5@huawei.com>
> Fixes: 19bfa9ebebb5 ("mtd: use refcount to prevent corruption")
> Reviewed-by: Tomas Winkler <tomas.winkler@intel.com>
> Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>

Applied to https://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux.git mtd/next, thanks.

Miquel

\
 
 \ /
  Last update: 2023-08-04 09:04    [W:0.035 / U:0.388 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site