From: Emese Revfy <re.emese@gmail.com>
To: dedekind1@gmail.com
Cc: dwmw2@infradead.org, linux-mtd@lists.infradead.org,
linux-kernel@vger.kernel.org
Subject: possible use-after-free in drivers/mtd/ubi/wl.c: erase_worker
Date: Wed, 4 Jan 2012 00:34:46 +0100 [thread overview]
Message-ID: <20120104003446.695fd426@gmail.com> (raw)
Hi,
I think I found a potential problem in drivers/mtd/ubi/wl.c in
erase_worker():
1050 ubi_err("failed to erase PEB %d, error %d", pnum, err);
1051 kfree(wl_wrk);
1052 kmem_cache_free(ubi_wl_entry_slab, e);
1053
1054 if (err == -EINTR || err == -ENOMEM || err == -EAGAIN ||
1055 err == -EBUSY) {
1056 int err1;
1057
1058 /* Re-schedule the LEB for erasure */
1059 err1 = schedule_erase(ubi, e, 0);
The pointer e is freed at line 1052 (kmem_cache_free), but
later it is passed to schedule_erase which will eventually call
erase_worker where it will be dereferenced and/or freed again.
It seems to have been introduced in commit
784c145444e7dd58ae740d406155b72ac658f151
Emese
next reply other threads:[~2012-01-03 23:34 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-01-03 23:34 Emese Revfy [this message]
2012-01-04 17:33 ` possible use-after-free in drivers/mtd/ubi/wl.c: erase_worker Josh Boyer
2012-01-05 9:14 ` Artem Bityutskiy
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20120104003446.695fd426@gmail.com \
--to=re.emese@gmail.com \
--cc=dedekind1@gmail.com \
--cc=dwmw2@infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mtd@lists.infradead.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox