| Message ID | 20231214072946.10285-1-dinghao.liu@zju.edu.cn |
|---|---|
| State | Accepted |
| Headers | show |
| Series | mtd: rawnand: diskonchip: fix a potential double free in doc_probe | expand |
On Thu, 2023-12-14 at 07:29:43 UTC, Dinghao Liu wrote: > When nand_scan() fails, it has cleaned up related resources > in its error paths. Therefore, the following nand_cleanup() > may lead to a double-free. One possible trace is: > > doc_probe > |-> nand_scan > | |-> nand_scan_with_ids > | |-> nand_scan_tail > | |-> kfree(chip->data_buf) [First free] > | > |-> nand_cleanup > |-> kfree(chip->data_buf) [Double free here] > > Fix this by removing nand_cleanup() on failure of > nand_scan(). > > Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn> Applied to https://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux.git nand/next, thanks. Miquel
diff --git a/drivers/mtd/nand/raw/diskonchip.c b/drivers/mtd/nand/raw/diskonchip.c index 5d2ddb037a9a..5243fab9face 100644 --- a/drivers/mtd/nand/raw/diskonchip.c +++ b/drivers/mtd/nand/raw/diskonchip.c @@ -1491,10 +1491,12 @@ static int __init doc_probe(unsigned long physadr) else numchips = doc2001_init(mtd); - if ((ret = nand_scan(nand, numchips)) || (ret = doc->late_init(mtd))) { - /* DBB note: i believe nand_cleanup is necessary here, as - buffers may have been allocated in nand_base. Check with - Thomas. FIX ME! */ + ret = nand_scan(nand, numchips); + if (ret) + goto fail; + + ret = doc->late_init(mtd); + if (ret) { nand_cleanup(nand); goto fail; }
When nand_scan() fails, it has cleaned up related resources in its error paths. Therefore, the following nand_cleanup() may lead to a double-free. One possible trace is: doc_probe |-> nand_scan | |-> nand_scan_with_ids | |-> nand_scan_tail | |-> kfree(chip->data_buf) [First free] | |-> nand_cleanup |-> kfree(chip->data_buf) [Double free here] Fix this by removing nand_cleanup() on failure of nand_scan(). Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn> --- drivers/mtd/nand/raw/diskonchip.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)