Zhihao Cheng 8c03a1c21d ubi: ubi_create_volume: Fix use-after-free when volume creation failed ...

There is an use-after-free problem for 'eba_tbl' in ubi_create_volume()'s
error handling path:

  ubi_eba_replace_table(vol, eba_tbl)
    vol->eba_tbl = tbl
out_mapping:
  ubi_eba_destroy_table(eba_tbl)   // Free 'eba_tbl'
out_unlock:
  put_device(&vol->dev)
    vol_release
      kfree(tbl->entries)	  // UAF

Fix it by removing redundant 'eba_tbl' releasing.
Fetch a reproducer in [Link].

Fixes: 493cfaeaa0c9b ("mtd: utilize new cdev_device_add helper function")
Link: https://bugzilla.kernel.org/show_bug.cgi?id=215965
Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
Signed-off-by: Richard Weinberger <richard@nod.at>

2022-05-27 16:49:41 +02:00

..

chips

mtd: gen_probe: Use bitmap_zalloc() when applicable

2021-12-09 17:52:29 +01:00

devices

Core MTD changes:

2022-03-25 13:35:34 -07:00

hyperbus

mtd: hyperbus: HBMC_AM654 should depend on ARCH_K3

2022-03-14 17:01:58 +01:00

lpddr

mtd: lpddr: fix excessive stack usage with clang

2020-08-27 14:36:07 +02:00

maps

MIPS: TXX9: Remove rbtx4939 board support

2022-01-02 14:10:40 +01:00

nand

mtd: rawnand: qcom: fix memory corruption that causes panic

2022-04-21 09:29:07 +02:00

parsers

SPI NOR core changes:

2022-03-18 20:14:42 +01:00

spi-nor

Core MTD changes:

2022-03-25 13:35:34 -07:00

tests

mtd: tests: Fix eraseblock read speed miscalculation for lower partition sizes

2022-03-14 17:01:47 +01:00

ubi

ubi: ubi_create_volume: Fix use-after-free when volume creation failed

2022-05-27 16:49:41 +02:00

ftl.c

mtd/ftl: don't cast away the type when calling add_mtd_blktrans_dev

2021-08-23 10:01:04 +02:00

inftlcore.c

mtd: inftlcore: Use module_mtd_blktrans to register driver

2021-03-11 09:37:48 +01:00

inftlmount.c

mtd: inftl: remove unnecessary oom message

2021-06-11 20:44:21 +02:00

Kconfig

mtdblock: Add comment about UBI block devices

2021-08-06 22:05:13 +02:00

Makefile

mtd: Support kmsg dumper based on pstore/blk

2020-05-31 19:49:01 -07:00

mtd_blkdevs.c

mtd_blkdevs: avoid soft lockups with some mtd/spi devices

2022-01-26 11:43:02 +01:00

mtdblock_ro.c

mtdblock: Warn if added for a NAND device

2021-08-17 18:41:59 +02:00

mtdblock.c

mtdblock: Warn if added for a NAND device

2021-08-17 18:41:59 +02:00

mtdchar.c

mtdchar: prevent unbounded allocation in MEMWRITE ioctl

2021-12-09 17:52:29 +01:00

mtdconcat.c

mtd: mtdconcat: Check _read, _write callbacks existence before assignment

2021-08-17 18:43:33 +02:00

mtdcore.c

Char/Misc and other driver updates for 5.18-rc1

2022-03-28 12:27:35 -07:00

mtdcore.h

mtd: Provide fs_context-aware mount_mtd() replacement

2019-09-05 14:34:23 -04:00

mtdoops.c

mtd: mtdoops: remove unnecessary oom message

2021-06-11 20:43:46 +02:00

mtdpart.c

mtd: Fixed breaking list in __mtd_del_partition.

2021-12-03 14:27:18 +01:00

mtdpstore.c

pstore/blk: Include zone in pstore_device_info

2021-06-16 21:09:31 -07:00

mtdsuper.c

mm: don't include <linux/blkdev.h> in <linux/backing-dev.h>

2021-10-18 06:17:01 -06:00

mtdswap.c

block: remove genhd.h

2022-02-02 07:49:59 -07:00

nftlcore.c

mtd: nftlcore: remove set but rewrite variables

2021-05-10 12:11:46 +02:00

nftlmount.c

mtd: nftl: remove unnecessary oom message

2021-06-11 20:43:26 +02:00

rfd_ftl.c

mtd/rfd_ftl: don't cast away the type when calling add_mtd_blktrans_dev

2021-08-23 10:01:06 +02:00

sm_ftl.c

drivers: mtd: sm_ftl: Fix alignment of block comment

2021-05-10 12:49:00 +02:00

sm_ftl.h

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500

2019-06-19 17:09:55 +02:00

ssfdc.c

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500

2019-06-19 17:09:55 +02:00