2023-12-14 08:06:53

by Dinghao Liu

Subject: [PATCH] mtd: rawnand: diskonchip: fix a potential double free in doc_probe

When nand_scan() fails, it has cleaned up related resources
in its error paths. Therefore, the following nand_cleanup()
may lead to a double-free. One possible trace is:

doc_probe
|-> nand_scan
| |-> nand_scan_with_ids
| |-> nand_scan_tail
| |-> kfree(chip->data_buf) [First free]
|
|-> nand_cleanup
|-> kfree(chip->data_buf) [Double free here]

Fix this by removing nand_cleanup() on failure of
nand_scan().

Signed-off-by: Dinghao Liu <[email protected]>
---
drivers/mtd/nand/raw/diskonchip.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/drivers/mtd/nand/raw/diskonchip.c b/drivers/mtd/nand/raw/diskonchip.c
index 5d2ddb037a9a..5243fab9face 100644
--- a/drivers/mtd/nand/raw/diskonchip.c
+++ b/drivers/mtd/nand/raw/diskonchip.c
@@ -1491,10 +1491,12 @@ static int __init doc_probe(unsigned long physadr)
else
numchips = doc2001_init(mtd);

- if ((ret = nand_scan(nand, numchips)) || (ret = doc->late_init(mtd))) {
- /* DBB note: i believe nand_cleanup is necessary here, as
- buffers may have been allocated in nand_base. Check with
- Thomas. FIX ME! */
+ ret = nand_scan(nand, numchips);
+ if (ret)
+ goto fail;
+
+ ret = doc->late_init(mtd);
+ if (ret) {
nand_cleanup(nand);
goto fail;
}
--
2.17.1

2023-12-15 10:59:27

by Miquel Raynal

Subject: Re: [PATCH] mtd: rawnand: diskonchip: fix a potential double free in doc_probe

On Thu, 2023-12-14 at 07:29:43 UTC, Dinghao Liu wrote:
> When nand_scan() fails, it has cleaned up related resources
> in its error paths. Therefore, the following nand_cleanup()
> may lead to a double-free. One possible trace is:
>
> doc_probe
> |-> nand_scan
> | |-> nand_scan_with_ids
> | |-> nand_scan_tail
> | |-> kfree(chip->data_buf) [First free]
> |
> |-> nand_cleanup
> |-> kfree(chip->data_buf) [Double free here]
>
> Fix this by removing nand_cleanup() on failure of
> nand_scan().
>
> Signed-off-by: Dinghao Liu <[email protected]>

Applied to https://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux.git nand/next, thanks.

Miquel