lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Fri, 21 Jan 2022 13:41:27 +0100 From: Ulf Hansson <ulf.hansson@...aro.org> To: Greg Kroah-Hartman <gregkh@...uxfoundation.org> Cc: linux-kernel@...r.kernel.org, Xiyu Yang <xiyuyang19@...an.edu.cn>, Xin Xiong <xiongx18@...an.edu.cn>, Xin Tan <tanxin.ctf@...il.com>, Tony Lindgren <tony@...mide.com>, Yang Li <yang.lee@...ux.alibaba.com>, linux-mmc@...r.kernel.org, stable <stable@...r.kernel.org>, whitehat002 <hackyzh002@...il.com> Subject: Re: [PATCH] moxart: fix potential use-after-free on remove path On Fri, 14 Jan 2022 at 08:59, Greg Kroah-Hartman <gregkh@...uxfoundation.org> wrote: > > It was reported that the mmc host structure could be accessed after it > was freed in moxart_remove(), so fix this by saving the base register of > the device and using it instead of the pointer dereference. > > Cc: Ulf Hansson <ulf.hansson@...aro.org> > Cc: Xiyu Yang <xiyuyang19@...an.edu.cn> > Cc: Xin Xiong <xiongx18@...an.edu.cn> > Cc: Xin Tan <tanxin.ctf@...il.com> > Cc: Tony Lindgren <tony@...mide.com> > Cc: Yang Li <yang.lee@...ux.alibaba.com> > Cc: linux-mmc@...r.kernel.org > Cc: stable <stable@...r.kernel.org> > Reported-by: whitehat002 <hackyzh002@...il.com> > Signed-off-by: Greg Kroah-Hartman <gregkh@...uxfoundation.org> > --- > drivers/mmc/host/moxart-mmc.c | 9 +++++---- > 1 file changed, 5 insertions(+), 4 deletions(-) > > diff --git a/drivers/mmc/host/moxart-mmc.c b/drivers/mmc/host/moxart-mmc.c > index 16d1c7a43d33..f5d96940a9b8 100644 > --- a/drivers/mmc/host/moxart-mmc.c > +++ b/drivers/mmc/host/moxart-mmc.c > @@ -697,6 +697,7 @@ static int moxart_remove(struct platform_device *pdev) > { > struct mmc_host *mmc = dev_get_drvdata(&pdev->dev); > struct moxart_host *host = mmc_priv(mmc); > + void __iomem *base = host->base; > > dev_set_drvdata(&pdev->dev, NULL); > > @@ -707,10 +708,10 @@ static int moxart_remove(struct platform_device *pdev) > mmc_remove_host(mmc); > mmc_free_host(mmc); > > - writel(0, host->base + REG_INTERRUPT_MASK); > - writel(0, host->base + REG_POWER_CONTROL); > - writel(readl(host->base + REG_CLOCK_CONTROL) | CLK_OFF, > - host->base + REG_CLOCK_CONTROL); Rather than doing it like this, I think it would be easier to move mmc_free_host() below this part. That's usually what mmc host drivers do clean up things in ->remove(). > + writel(0, base + REG_INTERRUPT_MASK); > + writel(0, base + REG_POWER_CONTROL); > + writel(readl(base + REG_CLOCK_CONTROL) | CLK_OFF, > + base + REG_CLOCK_CONTROL); > > return 0; > } Kind regards Uffe
Powered by blists - more mailing lists