| Message ID | 20181006090935.41714-1-houtao1@huawei.com |
|---|---|
| State | Accepted |
| Delegated to: | David Woodhouse |
| Headers | show |
| Series | jffs2: free jffs2_sb_info through jffs2_kill_sb() | expand |
ping ? On 2018/10/6 17:09, Hou Tao wrote: > When an invalid mount option is passed to jffs2, jffs2_parse_options() > will fail and jffs2_sb_info will be freed, but then jffs2_sb_info will > be used (use-after-free) and freeed (double-free) in jffs2_kill_sb(). > > Fix it by removing the buggy invocation of kfree() when getting invalid > mount options. > > Cc: stable@kernel.org > Signed-off-by: Hou Tao <houtao1@huawei.com> > --- > fs/jffs2/super.c | 4 +--- > 1 file changed, 1 insertion(+), 3 deletions(-) > > diff --git a/fs/jffs2/super.c b/fs/jffs2/super.c > index 87bdf0f4cba1..902a7dd10e5c 100644 > --- a/fs/jffs2/super.c > +++ b/fs/jffs2/super.c > @@ -285,10 +285,8 @@ static int jffs2_fill_super(struct super_block *sb, void *data, int silent) > sb->s_fs_info = c; > > ret = jffs2_parse_options(c, data); > - if (ret) { > - kfree(c); > + if (ret) > return -EINVAL; > - } > > /* Initialize JFFS2 superblock locks, the further initialization will > * be done later */ >
On Tue, Oct 16, 2018 at 7:53 AM Hou Tao <houtao1@huawei.com> wrote: > > ping ? > > On 2018/10/6 17:09, Hou Tao wrote: > > When an invalid mount option is passed to jffs2, jffs2_parse_options() > > will fail and jffs2_sb_info will be freed, but then jffs2_sb_info will > > be used (use-after-free) and freeed (double-free) in jffs2_kill_sb(). > > > > Fix it by removing the buggy invocation of kfree() when getting invalid > > mount options. > > > > Cc: stable@kernel.org > > Signed-off-by: Hou Tao <houtao1@huawei.com> > > --- > > fs/jffs2/super.c | 4 +--- > > 1 file changed, 1 insertion(+), 3 deletions(-) > > > > diff --git a/fs/jffs2/super.c b/fs/jffs2/super.c > > index 87bdf0f4cba1..902a7dd10e5c 100644 > > --- a/fs/jffs2/super.c > > +++ b/fs/jffs2/super.c > > @@ -285,10 +285,8 @@ static int jffs2_fill_super(struct super_block *sb, void *data, int silent) > > sb->s_fs_info = c; > > > > ret = jffs2_parse_options(c, data); > > - if (ret) { > > - kfree(c); > > + if (ret) > > return -EINVAL; > > - } Reviewed-by: Richard Weinberger <richard@nod.at> We can carry this via the MTD tree.
On 2018/10/16 14:41, Richard Weinberger wrote: > On Tue, Oct 16, 2018 at 7:53 AM Hou Tao <houtao1@huawei.com> wrote: >> >> ping ? >> >> On 2018/10/6 17:09, Hou Tao wrote: >>> When an invalid mount option is passed to jffs2, jffs2_parse_options() >>> will fail and jffs2_sb_info will be freed, but then jffs2_sb_info will >>> be used (use-after-free) and freeed (double-free) in jffs2_kill_sb(). >>> >>> Fix it by removing the buggy invocation of kfree() when getting invalid >>> mount options. >>> >>> Cc: stable@kernel.org >>> Signed-off-by: Hou Tao <houtao1@huawei.com> >>> --- >>> fs/jffs2/super.c | 4 +--- >>> 1 file changed, 1 insertion(+), 3 deletions(-) >>> >>> diff --git a/fs/jffs2/super.c b/fs/jffs2/super.c >>> index 87bdf0f4cba1..902a7dd10e5c 100644 >>> --- a/fs/jffs2/super.c >>> +++ b/fs/jffs2/super.c >>> @@ -285,10 +285,8 @@ static int jffs2_fill_super(struct super_block *sb, void *data, int silent) >>> sb->s_fs_info = c; >>> >>> ret = jffs2_parse_options(c, data); >>> - if (ret) { >>> - kfree(c); >>> + if (ret) >>> return -EINVAL; >>> - } > > Reviewed-by: Richard Weinberger <richard@nod.at> > > We can carry this via the MTD tree. Thanks for that. Regards, Tao
On Tue, 16 Oct 2018 18:26:34 +0800 Hou Tao <houtao1@huawei.com> wrote: > On 2018/10/16 14:41, Richard Weinberger wrote: > > On Tue, Oct 16, 2018 at 7:53 AM Hou Tao <houtao1@huawei.com> wrote: > >> > >> ping ? > >> > >> On 2018/10/6 17:09, Hou Tao wrote: > >>> When an invalid mount option is passed to jffs2, jffs2_parse_options() > >>> will fail and jffs2_sb_info will be freed, but then jffs2_sb_info will > >>> be used (use-after-free) and freeed (double-free) in jffs2_kill_sb(). > >>> > >>> Fix it by removing the buggy invocation of kfree() when getting invalid > >>> mount options. > >>> > >>> Cc: stable@kernel.org > >>> Signed-off-by: Hou Tao <houtao1@huawei.com> > >>> --- > >>> fs/jffs2/super.c | 4 +--- > >>> 1 file changed, 1 insertion(+), 3 deletions(-) > >>> > >>> diff --git a/fs/jffs2/super.c b/fs/jffs2/super.c > >>> index 87bdf0f4cba1..902a7dd10e5c 100644 > >>> --- a/fs/jffs2/super.c > >>> +++ b/fs/jffs2/super.c > >>> @@ -285,10 +285,8 @@ static int jffs2_fill_super(struct super_block *sb, void *data, int silent) > >>> sb->s_fs_info = c; > >>> > >>> ret = jffs2_parse_options(c, data); > >>> - if (ret) { > >>> - kfree(c); > >>> + if (ret) > >>> return -EINVAL; > >>> - } > > > > Reviewed-by: Richard Weinberger <richard@nod.at> > > > > We can carry this via the MTD tree. > Thanks for that. Applied after adding Fixes: 92abc475d8de ("jffs2: implement mount option parsing and compression overriding") > > Regards, > Tao > > > ______________________________________________________ > Linux MTD discussion mailing list > http://lists.infradead.org/mailman/listinfo/linux-mtd/
diff --git a/fs/jffs2/super.c b/fs/jffs2/super.c index 87bdf0f4cba1..902a7dd10e5c 100644 --- a/fs/jffs2/super.c +++ b/fs/jffs2/super.c @@ -285,10 +285,8 @@ static int jffs2_fill_super(struct super_block *sb, void *data, int silent) sb->s_fs_info = c; ret = jffs2_parse_options(c, data); - if (ret) { - kfree(c); + if (ret) return -EINVAL; - } /* Initialize JFFS2 superblock locks, the further initialization will * be done later */
When an invalid mount option is passed to jffs2, jffs2_parse_options() will fail and jffs2_sb_info will be freed, but then jffs2_sb_info will be used (use-after-free) and freeed (double-free) in jffs2_kill_sb(). Fix it by removing the buggy invocation of kfree() when getting invalid mount options. Cc: stable@kernel.org Signed-off-by: Hou Tao <houtao1@huawei.com> --- fs/jffs2/super.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)