Re: [PATCH] efi/capsule-loader: Fix use-after-free in efi_capsule_write

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Wed, 7 Sept 2022 at 17:17, Hyunwoo Kim <imv4bel@xxxxxxxxx> wrote:
>
> On Wed, Sep 07, 2022 at 07:54:26AM -0700, Hyunwoo Kim wrote:
> > efi_capsule_flush() seems to exist for the purpose of canceling uploads in the middle.
> >
> > If buffer release is moved to .release, will there be any compatibility issues?
>
> The way to submit capsules is to submit by calling write() multiple times by the user,
> rather than in a structure that processes the copy operation at once inside efi_capsule_write().
> In other words, if you just call close() when you want to cancel upload,
> .release is automatically called after write() is finished, and upload is stopped.
> So there is no need for .flush to exist.
>
> So I think it would be ok to move the buffer free part to .release.
>
> I'll submit you a v4 patch that moves the buffre free part to .release.

OK



[Index of Archives]     [Linux ARM Kernel]     [Linux ARM]     [Linux Omap]     [Fedora ARM]     [IETF Annouce]     [Security]     [Bugtraq]     [Linux OMAP]     [Linux MIPS]     [ECOS]     [Asterisk Internet PBX]     [Linux API]

  Powered by Linux