2020-05-22 07:25:48

by 彭浩(Richard)

[permalink] [raw]
Subject: [PATCH] mmc: fix use after free issue

This is caused by dereferencing 'rpmb' after put_device().

Signed-off-by: Peng Hao <[email protected]>
---
drivers/mmc/core/block.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
index 8499b56..e6e025c 100644
--- a/drivers/mmc/core/block.c
+++ b/drivers/mmc/core/block.c
@@ -2483,8 +2483,8 @@ static int mmc_rpmb_chrdev_release(struct inode *inode, struct file *filp)
struct mmc_rpmb_data *rpmb = container_of(inode->i_cdev,
struct mmc_rpmb_data, chrdev);

-put_device(&rpmb->dev);
mmc_blk_put(rpmb->md);
+put_device(&rpmb->dev);

return 0;
}
--
2.7.4
________________________________
OPPO

???????ʼ????丽??????OPPO??˾?ı?????Ϣ?????????ʼ?ָ?????ռ???ʹ?ã????????˼?Ⱥ?飩????ֹ?κ?????δ????Ȩ???????????κ???ʽʹ?á????????????˱??ʼ??????????Ե????ʼ?֪ͨ?????˲?ɾ?????ʼ????丽????

This e-mail and its attachments contain confidential information from OPPO, which is intended only for the person or entity whose address is listed above. Any use of the information contained herein in any way (including, but not limited to, total or partial disclosure, reproduction, or dissemination) by persons other than the intended recipient(s) is prohibited. If you receive this e-mail in error, please notify the sender by phone or email immediately and delete it!