tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

mtd: docg3: fix use-after-free in docg3_release()

In docg3_release(), the docg3 pointer is obtained from
cascade->floors[0]->priv before the loop that calls
doc_release_device() on each floor. doc_release_device() frees the
docg3 struct via kfree(docg3) at line 1881. After the loop,
docg3->cascade->bch dereferences the already-freed pointer.

Fix this by accessing cascade->bch directly, which is equivalent
since docg3->cascade points back to the same cascade struct, and
is already available as a local variable. This also removes the
now-unused docg3 local variable.

Fixes: c8ae3f744ddc ("lib/bch: Rework a little bit the exported function names")
Cc: stable@vger.kernel.org
Signed-off-by: James Kim <james010kim@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>

authored by

James Kim and committed by
Miquel Raynal ca19808b e19eaffc

+1 -2
+1 -2
drivers/mtd/devices/docg3.c
··· 2049 2049 static void docg3_release(struct platform_device *pdev) 2050 2050 { 2051 2051 struct docg3_cascade *cascade = platform_get_drvdata(pdev); 2052 - struct docg3 *docg3 = cascade->floors[0]->priv; 2053 2052 int floor; 2054 2053 2055 2054 doc_unregister_sysfs(pdev, cascade); ··· 2056 2057 if (cascade->floors[floor]) 2057 2058 doc_release_device(cascade->floors[floor]); 2058 2059 2059 - bch_free(docg3->cascade->bch); 2060 + bch_free(cascade->bch); 2060 2061 } 2061 2062 2062 2063 #ifdef CONFIG_OF