On Tue, Oct 16, 2018 at 7:53 AM Hou Tao <houtao1@xxxxxxxxxx> wrote: > > ping ? > > On 2018/10/6 17:09, Hou Tao wrote: > > When an invalid mount option is passed to jffs2, jffs2_parse_options() > > will fail and jffs2_sb_info will be freed, but then jffs2_sb_info will > > be used (use-after-free) and freeed (double-free) in jffs2_kill_sb(). > > > > Fix it by removing the buggy invocation of kfree() when getting invalid > > mount options. > > > > Cc: stable@xxxxxxxxxx > > Signed-off-by: Hou Tao <houtao1@xxxxxxxxxx> > > --- > > fs/jffs2/super.c | 4 +--- > > 1 file changed, 1 insertion(+), 3 deletions(-) > > > > diff --git a/fs/jffs2/super.c b/fs/jffs2/super.c > > index 87bdf0f4cba1..902a7dd10e5c 100644 > > --- a/fs/jffs2/super.c > > +++ b/fs/jffs2/super.c > > @@ -285,10 +285,8 @@ static int jffs2_fill_super(struct super_block *sb, void *data, int silent) > > sb->s_fs_info = c; > > > > ret = jffs2_parse_options(c, data); > > - if (ret) { > > - kfree(c); > > + if (ret) > > return -EINVAL; > > - } Reviewed-by: Richard Weinberger <richard@xxxxxx> We can carry this via the MTD tree. -- Thanks, //richard ______________________________________________________ Linux MTD discussion mailing list http://lists.infradead.org/mailman/listinfo/linux-mtd/