Unverified Commit be0b4454 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!4350 [sync] PR-4268: linux Mainline ubifs Fix Patch bacnport to 5.10 

Merge Pull Request from: @openeuler-sync-bot 
 

Origin pull request: 
https://gitee.com/openeuler/kernel/pulls/4268 
 
PR sync from: ZhaoLong Wang <wangzhaolong1@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/DCZWZJFDEBF6IRSN6IEQVC6MHS6KNASF/ 
revert the commit f13656bb for apply
d07cec9c238ae8fc6c1a9f3f5d30a2f8ec6cdc71

Backport d81efd66106c03771ffc8637855a6ec24caa6350

Konstantin Meskhidze (1):
  ubifs: fix possible dereference after free

ZhaoLong Wang (2):
  Revert "mtd/ubi/block: Fix uaf problem in ubiblock_cleanup"
  ubi: block: Fix use-after-free in ubiblock_cleanup


-- 
2.34.3
 
https://gitee.com/openeuler/kernel/issues/I8ZCT1 
 
Link:https://gitee.com/openeuler/kernel/pulls/4350

 

Reviewed-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
Signed-off-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
parents dd40f0e2 6cdff0d1

drivers/mtd/ubi/block.c

+3 −1
Original line number Diff line number Diff line
@@ -475,15 +475,17 @@ int ubiblock_create(struct ubi_volume_info *vi) 


static void ubiblock_cleanup(struct ubiblock *dev)

{

	int id = dev->gd->first_minor;



	/* Stop new requests to arrive */

	del_gendisk(dev->gd);

	/* Flush pending work */

	destroy_workqueue(dev->wq);

	/* Finally destroy the blk queue */

	dev_info(disk_to_dev(dev->gd), "released");

	idr_remove(&ubiblock_minor_idr, dev->gd->first_minor);

	blk_cleanup_disk(dev->gd);

	blk_mq_free_tag_set(&dev->tag_set);

	idr_remove(&ubiblock_minor_idr, id);

}



int ubiblock_remove(struct ubi_volume_info *vi)

fs/ubifs/tnc.c

+1 −0
Original line number Diff line number Diff line
@@ -65,6 +65,7 @@ static void do_insert_old_idx(struct ubifs_info *c, 
		else {

			ubifs_err(c, "old idx added twice!");

			kfree(old_idx);

			return;

		}

	}

	rb_link_node(&old_idx->rb, parent, p);