linux-kernel - Re: [PATCH 02/05] tmio_mmc: Fix use after free in remove()

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 11 Mar 2009 14:28:08 +0000
From:	Ian Molton <ian@...menth.co.uk>
To:	Magnus Damm <magnus.damm@...il.com>
CC:	linux-kernel@...r.kernel.org, drzeus-wbsd@...eus.cx,
	akpm@...ux-foundation.org
Subject: Re: [PATCH 02/05] tmio_mmc: Fix use after free in remove()

Magnus Damm wrote:
> From:  Magnus Damm <damm@...nsource.se>
> 
> Update the tmio_mmc code to call mmc_free_host() when
> done using the private data. Without this fix the driver
> frees memory and then keeps on using it as private data.
> 
> Signed-off-by: Magnus Damm <damm@...nsource.se>

Acked-by: Ian Molton <ian@...menth.co.uk>

> ---
> 
>  drivers/mmc/host/tmio_mmc.c |    2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> --- 0010/drivers/mmc/host/tmio_mmc.c
> +++ work/drivers/mmc/host/tmio_mmc.c	2009-03-11 19:24:03.000000000 +0900
> @@ -650,10 +650,10 @@ static int __devexit tmio_mmc_remove(str
>  	if (mmc) {
>  		struct tmio_mmc_host *host = mmc_priv(mmc);
>  		mmc_remove_host(mmc);
> -		mmc_free_host(mmc);
>  		free_irq(host->irq, host);
>  		iounmap(host->ctl);
>  		iounmap(host->cnf);
> +		mmc_free_host(mmc);
>  	}
>  
>  	return 0;
> 

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/