Zhihao Cheng 8c03a1c21d ubi: ubi_create_volume: Fix use-after-free when volume creation failed ... There is an use-after-free problem for 'eba_tbl' in ubi_create_volume()'s error handling path: ubi_eba_replace_table(vol, eba_tbl) vol->eba_tbl = tbl out_mapping: ubi_eba_destroy_table(eba_tbl) // Free 'eba_tbl' out_unlock: put_device(&vol->dev) vol_release kfree(tbl->entries) // UAF Fix it by removing redundant 'eba_tbl' releasing. Fetch a reproducer in [Link]. Fixes: 493cfaeaa0 ("mtd: utilize new cdev_device_add helper function") Link: https://bugzilla.kernel.org/show_bug.cgi?id=215965 Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com> Signed-off-by: Richard Weinberger <richard@nod.at>		2022-05-27 16:49:41 +02:00
..
Kconfig	…
Makefile	…
attach.c	…
block.c	block: remove GENHD_FL_EXT_DEVT	2021-11-29 06:38:35 -07:00
build.c	ubi: Fix race condition between ctrl_cdev_ioctl and ubi_cdev_ioctl	2022-01-09 21:13:28 +01:00
cdev.c	…
debug.c	ubi: Fix a mistake in comment	2021-12-23 20:23:40 +01:00
debug.h	…
eba.c	ubi: eba: Delete useless kfree code	2021-02-12 21:53:22 +01:00
fastmap-wl.c	ubi: fastmap: Check wl_pool for free peb before wear leveling	2022-05-27 16:49:07 +02:00
fastmap.c	ubi: fastmap: Fix high cpu usage of ubi_bgt by making sure wl_pool not empty	2022-05-27 16:46:02 +02:00
gluebi.c	mtd: ubi: gluebi: Fix misnamed function parameter documentation	2020-11-20 12:37:32 +01:00
io.c	ubi: remove dead code in validate_vid_hdr()	2021-02-12 21:53:22 +01:00
kapi.c	mtd: ubi: kapi: Correct documentation for 'ubi_leb_read_sg's 'sgl' parameter	2020-11-20 12:37:31 +01:00
misc.c	…
ubi-media.h	…
ubi.h	ubi: fastmap: Fix high cpu usage of ubi_bgt by making sure wl_pool not empty	2022-05-27 16:46:02 +02:00
upd.c	…
vmt.c	ubi: ubi_create_volume: Fix use-after-free when volume creation failed	2022-05-27 16:49:41 +02:00
vtbl.c	…
wl.c	ubi: fastmap: Check wl_pool for free peb before wear leveling	2022-05-27 16:49:07 +02:00
wl.h	ubi: fastmap: Check wl_pool for free peb before wear leveling	2022-05-27 16:49:07 +02:00