Re: [PATCH] efi/capsule-loader: Fix use-after-free in efi_capsule_write

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Wed, Sep 07, 2022 at 04:40:08PM +0200, Ard Biesheuvel wrote:
> As far as your fix is concerned: wouldn't it be better to move the
> freeing of the pages to the release hook? Semantically, flush is not
> the right place for this, AFAICT.

you're right. Freeing the buffer in .flush is wrong.
I also think it's appropriate to move the buffer release part to .release.

But looking at the comments,
/**
 * efi_capsule_flush - called by file close or file flush
 * @file: file pointer
 * @id: not used
 *
 *      If a capsule is being partially uploaded then calling this function
 *      will be treated as upload termination and will free those completed
 *      buffer pages and -ECANCELED will be returned.
 **/

efi_capsule_flush() seems to exist for the purpose of canceling uploads in the middle.

If buffer release is moved to .release, will there be any compatibility issues?



[Index of Archives]     [Linux ARM Kernel]     [Linux ARM]     [Linux Omap]     [Fedora ARM]     [IETF Annouce]     [Security]     [Bugtraq]     [Linux OMAP]     [Linux MIPS]     [ECOS]     [Asterisk Internet PBX]     [Linux API]

  Powered by Linux