| Message ID | 20220715071119.2321463-1-cuigaosheng1@huawei.com |
|---|---|
| State | Changes Requested |
| Headers | show |
| Series | [-next] mtd/ftl: Fix uaf in ftl_remove_dev() | expand |
PING 在 2022/7/15 15:11, Gaosheng Cui 写道: > del_mtd_blktrans_dev will reclaim the resources of mtd_blktrans_dev, > and call kfree(dev) in blktrans_dev_put to release the memory of > mtd_blktrans_dev, so when ftl_freepart reclaims the memory of other > member pointers of the partition_t, it will trigger the uaf problem, > Fix it by moving ftl_freepart in front of del_mtd_blktrans_dev. > > Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") > Signed-off-by: Gaosheng Cui <cuigaosheng1@huawei.com> > --- > drivers/mtd/ftl.c | 6 +++++- > 1 file changed, 5 insertions(+), 1 deletion(-) > > diff --git a/drivers/mtd/ftl.c b/drivers/mtd/ftl.c > index 200271bdc7aa..bec56070039d 100644 > --- a/drivers/mtd/ftl.c > +++ b/drivers/mtd/ftl.c > @@ -1039,8 +1039,12 @@ static void ftl_add_mtd(struct mtd_blktrans_ops *tr, struct mtd_info *mtd) > > static void ftl_remove_dev(struct mtd_blktrans_dev *dev) > { > + struct partition_t *partition; > + > + partition = container_of(dev, struct partition_t, mbd); > + > + ftl_freepart(partition); > del_mtd_blktrans_dev(dev); > - ftl_freepart((partition_t *)dev); > } > > static struct mtd_blktrans_ops ftl_tr = {
diff --git a/drivers/mtd/ftl.c b/drivers/mtd/ftl.c index 200271bdc7aa..bec56070039d 100644 --- a/drivers/mtd/ftl.c +++ b/drivers/mtd/ftl.c @@ -1039,8 +1039,12 @@ static void ftl_add_mtd(struct mtd_blktrans_ops *tr, struct mtd_info *mtd) static void ftl_remove_dev(struct mtd_blktrans_dev *dev) { + struct partition_t *partition; + + partition = container_of(dev, struct partition_t, mbd); + + ftl_freepart(partition); del_mtd_blktrans_dev(dev); - ftl_freepart((partition_t *)dev); } static struct mtd_blktrans_ops ftl_tr = {
del_mtd_blktrans_dev will reclaim the resources of mtd_blktrans_dev, and call kfree(dev) in blktrans_dev_put to release the memory of mtd_blktrans_dev, so when ftl_freepart reclaims the memory of other member pointers of the partition_t, it will trigger the uaf problem, Fix it by moving ftl_freepart in front of del_mtd_blktrans_dev. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Gaosheng Cui <cuigaosheng1@huawei.com> --- drivers/mtd/ftl.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)