linux-kernel - Re: [PATCH] memstick: fix a double-free bug in memstick

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAPDyKFqnram9LrgtLP8k-HncBYXKR3HRprfMZPyxqrpZKztTSA@mail.gmail.com>
Date:   Mon, 23 Nov 2020 17:07:15 +0100
From:   Ulf Hansson <ulf.hansson@...aro.org>
To:     Qinglang Miao <miaoqinglang@...wei.com>
Cc:     Maxim Levitsky <maximlevitsky@...il.com>,
        Alex Dubov <oakad@...oo.com>,
        "linux-mmc@...r.kernel.org" <linux-mmc@...r.kernel.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] memstick: fix a double-free bug in memstick_check

On Fri, 20 Nov 2020 at 08:44, Qinglang Miao <miaoqinglang@...wei.com> wrote:
>
> kfree(host->card) has been called in put_device so that
> another kfree would raise cause a double-free bug.
>
> Fixes: 0193383a5833 ("memstick: core: fix device_register() error handling")
> Reported-by: Hulk Robot <hulkci@...wei.com>
> Signed-off-by: Qinglang Miao <miaoqinglang@...wei.com>

Applied for next, thanks!

Kind regards
Uffe


> ---
>  drivers/memstick/core/memstick.c | 1 -
>  1 file changed, 1 deletion(-)
>
> diff --git a/drivers/memstick/core/memstick.c b/drivers/memstick/core/memstick.c
> index ef03d6faf..12bc3f5a6 100644
> --- a/drivers/memstick/core/memstick.c
> +++ b/drivers/memstick/core/memstick.c
> @@ -468,7 +468,6 @@ static void memstick_check(struct work_struct *work)
>                         host->card = card;
>                         if (device_register(&card->dev)) {
>                                 put_device(&card->dev);
> -                               kfree(host->card);
>                                 host->card = NULL;
>                         }
>                 } else
> --
> 2.23.0
>