ubi: Fix possible null-ptr-deref in ubi_free_volume()
stable inclusion from stable-v5.10.173 commit fcbc795abe7897da4b5d2a6ab5010e36774b00c2 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7X0QU Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=fcbc795abe7897da4b5d2a6ab5010e36774b00c2 -------------------------------- [ Upstream commit c15859bf ] It willl cause null-ptr-deref in the following case: uif_init() ubi_add_volume() cdev_add() -> if it fails, call kill_volumes() device_register() kill_volumes() -> if ubi_add_volume() fails call this function ubi_free_volume() cdev_del() device_unregister() -> trying to delete a not added device, it causes null-ptr-deref So in ubi_free_volume(), it delete devices whether they are added or not, it will causes null-ptr-deref. Handle the error case whlie calling ubi_add_volume() to fix this problem. If add volume fails, set the corresponding vol to null, so it can not be accessed in kill_volumes() and release the resource in ubi_add_volume() error path. Fixes: 801c135c ("UBI: Unsorted Block Images") Suggested-by:Zhihao Cheng <chengzhihao1@huawei.com> Signed-off-by:
Yang Yingliang <yangyingliang@huawei.com> Reviewed-by:
Zhihao Cheng <chengzhihao1@huawei.com> Signed-off-by:
Richard Weinberger <richard@nod.at> Signed-off-by:
Sasha Levin <sashal@kernel.org> Signed-off-by:
sanglipeng <sanglipeng1@jd.com>
Loading
Please sign in to comment