* mmc: core: fix possible use after free of host
@ 2019-04-17 8:28 Pan Bian
2019-04-26 8:41 ` Mathieu Malaterre
2019-04-29 10:44 ` Ulf Hansson
0 siblings, 2 replies; 3+ messages in thread
From: Pan Bian @ 2019-04-17 8:28 UTC (permalink / raw)
To: Ulf Hansson, Linus Walleij, Shawn Lin, Martin Blumenstingl,
Gustavo A. R. Silva
Cc: Tony Lindgren, Mathieu Malaterre, linux-mmc, linux-kernel, Pan Bian
In the function mmc_alloc_host, the function put_device is called to
release allocated resources when mmc_gpio_alloc fails. Finally, the
function pointed by host->class_dev.class->dev_release (i.e.,
mmc_host_classdev_release) is used to release resources including the
host structure. However, after put_device, host is used and released
again. Resulting in a use-after-free bug.
Fixes: 1ed21719448("mmc: core: fix error path in mmc_host_alloc")
Signed-off-by: Pan Bian <bianpan2016@163.com>
---
drivers/mmc/core/host.c | 2 --
1 file changed, 2 deletions(-)
diff --git a/drivers/mmc/core/host.c b/drivers/mmc/core/host.c
index 3a4402a..f8ac567 100644
--- a/drivers/mmc/core/host.c
+++ b/drivers/mmc/core/host.c
@@ -429,8 +429,6 @@ struct mmc_host *mmc_alloc_host(int extra, struct device *dev)
if (mmc_gpio_alloc(host)) {
put_device(&host->class_dev);
- ida_simple_remove(&mmc_host_ida, host->index);
- kfree(host);
return NULL;
}
--
2.7.4
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: mmc: core: fix possible use after free of host
2019-04-17 8:28 mmc: core: fix possible use after free of host Pan Bian
@ 2019-04-26 8:41 ` Mathieu Malaterre
2019-04-29 10:44 ` Ulf Hansson
1 sibling, 0 replies; 3+ messages in thread
From: Mathieu Malaterre @ 2019-04-26 8:41 UTC (permalink / raw)
To: Pan Bian
Cc: Ulf Hansson, Linus Walleij, Shawn Lin, Martin Blumenstingl,
Gustavo A. R. Silva, Tony Lindgren, linux-mmc, LKML,
Heiner Kallweit
On Wed, Apr 17, 2019 at 10:28 AM Pan Bian <bianpan2016@163.com> wrote:
>
> In the function mmc_alloc_host, the function put_device is called to
> release allocated resources when mmc_gpio_alloc fails. Finally, the
> function pointed by host->class_dev.class->dev_release (i.e.,
> mmc_host_classdev_release) is used to release resources including the
> host structure. However, after put_device, host is used and released
> again. Resulting in a use-after-free bug.
>
> Fixes: 1ed21719448("mmc: core: fix error path in mmc_host_alloc")
The original commit 1ed21719448 looks correct to me (see
mmc_host_classdev_release).
> Signed-off-by: Pan Bian <bianpan2016@163.com>
> ---
> drivers/mmc/core/host.c | 2 --
> 1 file changed, 2 deletions(-)
>
> diff --git a/drivers/mmc/core/host.c b/drivers/mmc/core/host.c
> index 3a4402a..f8ac567 100644
> --- a/drivers/mmc/core/host.c
> +++ b/drivers/mmc/core/host.c
> @@ -429,8 +429,6 @@ struct mmc_host *mmc_alloc_host(int extra, struct device *dev)
>
> if (mmc_gpio_alloc(host)) {
> put_device(&host->class_dev);
> - ida_simple_remove(&mmc_host_ida, host->index);
> - kfree(host);
> return NULL;
> }
>
> --
> 2.7.4
>
>
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: mmc: core: fix possible use after free of host
2019-04-17 8:28 mmc: core: fix possible use after free of host Pan Bian
2019-04-26 8:41 ` Mathieu Malaterre
@ 2019-04-29 10:44 ` Ulf Hansson
1 sibling, 0 replies; 3+ messages in thread
From: Ulf Hansson @ 2019-04-29 10:44 UTC (permalink / raw)
To: Pan Bian
Cc: Linus Walleij, Shawn Lin, Martin Blumenstingl,
Gustavo A. R. Silva, Tony Lindgren, Mathieu Malaterre, linux-mmc,
Linux Kernel Mailing List
On Wed, 17 Apr 2019 at 10:29, Pan Bian <bianpan2016@163.com> wrote:
>
> In the function mmc_alloc_host, the function put_device is called to
> release allocated resources when mmc_gpio_alloc fails. Finally, the
> function pointed by host->class_dev.class->dev_release (i.e.,
> mmc_host_classdev_release) is used to release resources including the
> host structure. However, after put_device, host is used and released
> again. Resulting in a use-after-free bug.
>
> Fixes: 1ed21719448("mmc: core: fix error path in mmc_host_alloc")
> Signed-off-by: Pan Bian <bianpan2016@163.com>
Applied for next, thanks!
Kind regards
Uffe
> ---
> drivers/mmc/core/host.c | 2 --
> 1 file changed, 2 deletions(-)
>
> diff --git a/drivers/mmc/core/host.c b/drivers/mmc/core/host.c
> index 3a4402a..f8ac567 100644
> --- a/drivers/mmc/core/host.c
> +++ b/drivers/mmc/core/host.c
> @@ -429,8 +429,6 @@ struct mmc_host *mmc_alloc_host(int extra, struct device *dev)
>
> if (mmc_gpio_alloc(host)) {
> put_device(&host->class_dev);
> - ida_simple_remove(&mmc_host_ida, host->index);
> - kfree(host);
> return NULL;
> }
>
> --
> 2.7.4
>
>
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2019-04-29 10:45 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-04-17 8:28 mmc: core: fix possible use after free of host Pan Bian
2019-04-26 8:41 ` Mathieu Malaterre
2019-04-29 10:44 ` Ulf Hansson
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®