lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Thu, 18 Aug 2022 09:32:13 +0800 From: cuigaosheng <cuigaosheng1@...wei.com> To: <miquel.raynal@...tlin.com>, <richard@....at>, <vigneshr@...com>, <cuigaosheng1@...wei.com> CC: <linux-mtd@...ts.infradead.org>, <linux-kernel@...r.kernel.org>, <gongruiqi1@...wei.com>, <wangweiyang2@...wei.com> Subject: Re: [PATCH -next] mtd/ftl: Fix uaf in ftl_remove_dev() PING 在 2022/7/15 15:11, Gaosheng Cui 写道: > del_mtd_blktrans_dev will reclaim the resources of mtd_blktrans_dev, > and call kfree(dev) in blktrans_dev_put to release the memory of > mtd_blktrans_dev, so when ftl_freepart reclaims the memory of other > member pointers of the partition_t, it will trigger the uaf problem, > Fix it by moving ftl_freepart in front of del_mtd_blktrans_dev. > > Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") > Signed-off-by: Gaosheng Cui <cuigaosheng1@...wei.com> > --- > drivers/mtd/ftl.c | 6 +++++- > 1 file changed, 5 insertions(+), 1 deletion(-) > > diff --git a/drivers/mtd/ftl.c b/drivers/mtd/ftl.c > index 200271bdc7aa..bec56070039d 100644 > --- a/drivers/mtd/ftl.c > +++ b/drivers/mtd/ftl.c > @@ -1039,8 +1039,12 @@ static void ftl_add_mtd(struct mtd_blktrans_ops *tr, struct mtd_info *mtd) > > static void ftl_remove_dev(struct mtd_blktrans_dev *dev) > { > + struct partition_t *partition; > + > + partition = container_of(dev, struct partition_t, mbd); > + > + ftl_freepart(partition); > del_mtd_blktrans_dev(dev); > - ftl_freepart((partition_t *)dev); > } > > static struct mtd_blktrans_ops ftl_tr = {
Powered by blists - more mailing lists