linux-kernel - Re: [PATCH] mm: dmapool: fix possible use after free in dmam_pool

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Thu, 02 Jun 2011 11:47:36 +0200
From:	Rolf Eike Beer <eike-kernel@...tec.de>
To:	Maxin B John <maxin.john@...il.com>
Cc:	linux-mm@...ck.org, linux-kernel@...r.kernel.org,
	akpm@...ux-foundation.org, dima@...roid.com, willy@...ux.intel.com
Subject: Re: [PATCH] mm: dmapool: fix possible use after free in dmam_pool_destroy()

Maxin B John wrote:
> "dma_pool_destroy(pool)" calls "kfree(pool)". The freed pointer "pool"
> is again passed as an argument to the function "devres_destroy()".
> This patch fixes the possible use after free.
> 
> Please let me know your comments.

The pool itself is not used there, only the address where the pool has been. 
This will only lead to any trouble if something else is allocated to the same 
place and inserted into the devres list of the same device between the 
dma_pool_destroy() and devres_destroy().

But I agree that this is bad style. But if you are going to change this please 
also have a look at devm_iounmap() in lib/devres.c. Maybe also the devm_*irq* 
functions need the same changes.

Eike
Download attachment "signature.asc" of type "application/pgp-signature" (199 bytes)