Patch "mtd: Fix gluebi NULL pointer dereference caused by ftl notifier" has been added to the 5.10-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    mtd: Fix gluebi NULL pointer dereference caused by ftl notifier

to the 5.10-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     mtd-fix-gluebi-null-pointer-dereference-caused-by-ft.patch
and it can be found in the queue-5.10 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 30d8e2824277808634fa3d4d54d78a29bae8b64a
Author: ZhaoLong Wang <wangzhaolong1@xxxxxxxxxx>
Date:   Wed Dec 20 10:46:19 2023 +0800

    mtd: Fix gluebi NULL pointer dereference caused by ftl notifier
    
    [ Upstream commit a43bdc376deab5fff1ceb93dca55bcab8dbdc1d6 ]
    
    If both ftl.ko and gluebi.ko are loaded, the notifier of ftl
    triggers NULL pointer dereference when trying to access
    ‘gluebi->desc’ in gluebi_read().
    
    ubi_gluebi_init
      ubi_register_volume_notifier
        ubi_enumerate_volumes
          ubi_notify_all
            gluebi_notify    nb->notifier_call()
              gluebi_create
                mtd_device_register
                  mtd_device_parse_register
                    add_mtd_device
                      blktrans_notify_add   not->add()
                        ftl_add_mtd         tr->add_mtd()
                          scan_header
                            mtd_read
                              mtd_read_oob
                                mtd_read_oob_std
                                  gluebi_read   mtd->read()
                                    gluebi->desc - NULL
    
    Detailed reproduction information available at the Link [1],
    
    In the normal case, obtain gluebi->desc in the gluebi_get_device(),
    and access gluebi->desc in the gluebi_read(). However,
    gluebi_get_device() is not executed in advance in the
    ftl_add_mtd() process, which leads to NULL pointer dereference.
    
    The solution for the gluebi module is to run jffs2 on the UBI
    volume without considering working with ftl or mtdblock [2].
    Therefore, this problem can be avoided by preventing gluebi from
    creating the mtdblock device after creating mtd partition of the
    type MTD_UBIVOLUME.
    
    Fixes: 2ba3d76a1e29 ("UBI: make gluebi a separate module")
    Link: https://bugzilla.kernel.org/show_bug.cgi?id=217992 [1]
    Link: https://lore.kernel.org/lkml/441107100.23734.1697904580252.JavaMail.zimbra@xxxxxx/ [2]
    Signed-off-by: ZhaoLong Wang <wangzhaolong1@xxxxxxxxxx>
    Reviewed-by: Zhihao Cheng <chengzhihao1@xxxxxxxxxx>
    Acked-by: Richard Weinberger <richard@xxxxxx>
    Signed-off-by: Miquel Raynal <miquel.raynal@xxxxxxxxxxx>
    Link: https://lore.kernel.org/linux-mtd/20231220024619.2138625-1-wangzhaolong1@xxxxxxxxxx
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/mtd/mtd_blkdevs.c b/drivers/mtd/mtd_blkdevs.c
index 0c05f77f9b21..dd0d0bf5f57f 100644
--- a/drivers/mtd/mtd_blkdevs.c
+++ b/drivers/mtd/mtd_blkdevs.c
@@ -533,7 +533,7 @@ static void blktrans_notify_add(struct mtd_info *mtd)
 {
 	struct mtd_blktrans_ops *tr;
 
-	if (mtd->type == MTD_ABSENT)
+	if (mtd->type == MTD_ABSENT || mtd->type == MTD_UBIVOLUME)
 		return;
 
 	list_for_each_entry(tr, &blktrans_majors, list)
@@ -576,7 +576,7 @@ int register_mtd_blktrans(struct mtd_blktrans_ops *tr)
 	list_add(&tr->list, &blktrans_majors);
 
 	mtd_for_each_device(mtd)
-		if (mtd->type != MTD_ABSENT)
+		if (mtd->type != MTD_ABSENT && mtd->type != MTD_UBIVOLUME)
 			tr->add_mtd(tr, mtd);
 
 	mutex_unlock(&mtd_table_mutex);




[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux