Zhihao Cheng 5ff2514e4f ubi: ubi_create_volume: Fix use-after-free when volume creation failed ... [ Upstream commit 8c03a1c21d ] There is an use-after-free problem for 'eba_tbl' in ubi_create_volume()'s error handling path: ubi_eba_replace_table(vol, eba_tbl) vol->eba_tbl = tbl out_mapping: ubi_eba_destroy_table(eba_tbl) // Free 'eba_tbl' out_unlock: put_device(&vol->dev) vol_release kfree(tbl->entries) // UAF Fix it by removing redundant 'eba_tbl' releasing. Fetch a reproducer in [Link]. Fixes: 493cfaeaa0 ("mtd: utilize new cdev_device_add helper function") Link: https://bugzilla.kernel.org/show_bug.cgi?id=215965 Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com> Signed-off-by: Richard Weinberger <richard@nod.at> Signed-off-by: Sasha Levin <sashal@kernel.org>		2022-06-14 18:36:10 +02:00
..
Kconfig	…
Makefile	…
attach.c	…
block.c	ubi: use blk_mq_alloc_disk and blk_cleanup_disk	2021-06-11 11:54:43 -06:00
build.c	ubi: Fix race condition between ctrl_cdev_ioctl and ubi_cdev_ioctl	2022-04-08 14:24:11 +02:00
cdev.c	…
debug.c	ubifs: fix snprintf() checking	2021-06-18 22:04:47 +02:00
debug.h	…
eba.c	ubi: eba: Delete useless kfree code	2021-02-12 21:53:22 +01:00
fastmap-wl.c	ubi: fastmap: Fix high cpu usage of ubi_bgt by making sure wl_pool not empty	2022-06-14 18:36:10 +02:00
fastmap.c	ubi: fastmap: Fix high cpu usage of ubi_bgt by making sure wl_pool not empty	2022-06-14 18:36:10 +02:00
gluebi.c	…
io.c	ubi: remove dead code in validate_vid_hdr()	2021-02-12 21:53:22 +01:00
kapi.c	…
misc.c	…
ubi-media.h	…
ubi.h	ubi: fastmap: Fix high cpu usage of ubi_bgt by making sure wl_pool not empty	2022-06-14 18:36:10 +02:00
upd.c	…
vmt.c	ubi: ubi_create_volume: Fix use-after-free when volume creation failed	2022-06-14 18:36:10 +02:00
vtbl.c	…
wl.c	ubi: fastmap: Fix high cpu usage of ubi_bgt by making sure wl_pool not empty	2022-06-14 18:36:10 +02:00
wl.h	…