From: Vincent Whitchurch <vincent.whitchurch@axis.com>
To: Richard Weinberger <richard@nod.at>,
Miquel Raynal <miquel.raynal@bootlin.com>,
Vignesh Raghavendra <vigneshr@ti.com>
Cc: <linux-mtd@lists.infradead.org>, <linux-kernel@vger.kernel.org>,
<kernel@axis.com>,
Vincent Whitchurch <vincent.whitchurch@axis.com>
Subject: [PATCH 1/2] ubi: block: Fix use-after-free of gendisk
Date: Tue, 23 May 2023 15:12:16 +0200 [thread overview]
Message-ID: <20230523-ubiblock-remove-v1-1-240bed75849b@axis.com> (raw)
In-Reply-To: <20230523-ubiblock-remove-v1-0-240bed75849b@axis.com>
Do not touch the gendisk after put_disk() to fix this use-after-free:
==================================================
BUG: KASAN: slab-use-after-free in ubiblock_remove
Read of size 4 by task ubiblock/361
Call Trace:
ubiblock_remove (drivers/mtd/ubi/block.c:459 drivers/mtd/ubi/block.c:483)
vol_cdev_ioctl
...
Allocated by task 358:
__alloc_disk_node (block/genhd.c:1377)
__blk_mq_alloc_disk (block/blk-mq.c:4093)
ubiblock_create (drivers/mtd/ubi/block.c:397)
vol_cdev_ioctl
...
Freed by task 0:
bdev_free_inode (block/bdev.c:337)
i_callback
rcu_core
__do_softirq
...
Signed-off-by: Vincent Whitchurch <vincent.whitchurch@axis.com>
---
drivers/mtd/ubi/block.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/mtd/ubi/block.c b/drivers/mtd/ubi/block.c
index 3711d7f74600..70caec4606cd 100644
--- a/drivers/mtd/ubi/block.c
+++ b/drivers/mtd/ubi/block.c
@@ -448,13 +448,15 @@ int ubiblock_create(struct ubi_volume_info *vi)
static void ubiblock_cleanup(struct ubiblock *dev)
{
+ int first_minor = dev->gd->first_minor;
+
/* Stop new requests to arrive */
del_gendisk(dev->gd);
/* Finally destroy the blk queue */
dev_info(disk_to_dev(dev->gd), "released");
put_disk(dev->gd);
blk_mq_free_tag_set(&dev->tag_set);
- idr_remove(&ubiblock_minor_idr, dev->gd->first_minor);
+ idr_remove(&ubiblock_minor_idr, first_minor);
}
int ubiblock_remove(struct ubi_volume_info *vi)
--
2.34.1
______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/
next prev parent reply other threads:[~2023-05-23 13:13 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-05-23 13:12 [PATCH 0/2] ubi: block: fix use-after-free and deadlock Vincent Whitchurch
2023-05-23 13:12 ` Vincent Whitchurch [this message]
2023-05-24 5:58 ` [PATCH 1/2] ubi: block: Fix use-after-free of gendisk Christoph Hellwig
2023-05-23 13:12 ` [PATCH 2/2] ubi: block: Fix deadlock on remove Vincent Whitchurch
2023-05-24 6:04 ` Christoph Hellwig
2023-05-24 13:36 ` Vincent Whitchurch
2023-05-25 9:50 ` hch
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230523-ubiblock-remove-v1-1-240bed75849b@axis.com \
--to=vincent.whitchurch@axis.com \
--cc=kernel@axis.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mtd@lists.infradead.org \
--cc=miquel.raynal@bootlin.com \
--cc=richard@nod.at \
--cc=vigneshr@ti.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox