Zhihao Cheng 5ff2514e4f ubi: ubi_create_volume: Fix use-after-free when volume creation failed ... [ Upstream commit 8c03a1c21d ] There is an use-after-free problem for 'eba_tbl' in ubi_create_volume()'s error handling path: ubi_eba_replace_table(vol, eba_tbl) vol->eba_tbl = tbl out_mapping: ubi_eba_destroy_table(eba_tbl) // Free 'eba_tbl' out_unlock: put_device(&vol->dev) vol_release kfree(tbl->entries) // UAF Fix it by removing redundant 'eba_tbl' releasing. Fetch a reproducer in [Link]. Fixes: 493cfaeaa0 ("mtd: utilize new cdev_device_add helper function") Link: https://bugzilla.kernel.org/show_bug.cgi?id=215965 Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com> Signed-off-by: Richard Weinberger <richard@nod.at> Signed-off-by: Sasha Levin <sashal@kernel.org>		2022-06-14 18:36:10 +02:00
..
attach.c
block.c	ubi: use blk_mq_alloc_disk and blk_cleanup_disk	2021-06-11 11:54:43 -06:00
build.c	ubi: Fix race condition between ctrl_cdev_ioctl and ubi_cdev_ioctl	2022-04-08 14:24:11 +02:00
cdev.c
debug.c	ubifs: fix snprintf() checking	2021-06-18 22:04:47 +02:00
debug.h
eba.c	ubi: eba: Delete useless kfree code	2021-02-12 21:53:22 +01:00
fastmap-wl.c	ubi: fastmap: Fix high cpu usage of ubi_bgt by making sure wl_pool not empty	2022-06-14 18:36:10 +02:00
fastmap.c	ubi: fastmap: Fix high cpu usage of ubi_bgt by making sure wl_pool not empty	2022-06-14 18:36:10 +02:00
gluebi.c	mtd: ubi: gluebi: Fix misnamed function parameter documentation	2020-11-20 12:37:32 +01:00
io.c	ubi: remove dead code in validate_vid_hdr()	2021-02-12 21:53:22 +01:00
kapi.c	mtd: ubi: kapi: Correct documentation for 'ubi_leb_read_sg's 'sgl' parameter	2020-11-20 12:37:31 +01:00
Kconfig
Makefile
misc.c
ubi-media.h
ubi.h	ubi: fastmap: Fix high cpu usage of ubi_bgt by making sure wl_pool not empty	2022-06-14 18:36:10 +02:00
upd.c
vmt.c	ubi: ubi_create_volume: Fix use-after-free when volume creation failed	2022-06-14 18:36:10 +02:00
vtbl.c
wl.c	ubi: fastmap: Fix high cpu usage of ubi_bgt by making sure wl_pool not empty	2022-06-14 18:36:10 +02:00
wl.h