kevin/linux
1
Fork 0
Code

mtd: Fix gluebi NULL pointer dereference caused by ftl notifier

Browse Source 
If both ftl.ko and gluebi.ko are loaded, the notifier of ftl
triggers NULL pointer dereference when trying to access
‘gluebi->desc’ in gluebi_read().

ubi_gluebi_init
  ubi_register_volume_notifier
    ubi_enumerate_volumes
      ubi_notify_all
        gluebi_notify    nb->notifier_call()
          gluebi_create
            mtd_device_register
              mtd_device_parse_register
                add_mtd_device
                  blktrans_notify_add   not->add()
                    ftl_add_mtd         tr->add_mtd()
                      scan_header
                        mtd_read
                          mtd_read_oob
                            mtd_read_oob_std
                              gluebi_read   mtd->read()
                                gluebi->desc - NULL

Detailed reproduction information available at the Link [1],

In the normal case, obtain gluebi->desc in the gluebi_get_device(),
and access gluebi->desc in the gluebi_read(). However,
gluebi_get_device() is not executed in advance in the
ftl_add_mtd() process, which leads to NULL pointer dereference.

The solution for the gluebi module is to run jffs2 on the UBI
volume without considering working with ftl or mtdblock [2].
Therefore, this problem can be avoided by preventing gluebi from
creating the mtdblock device after creating mtd partition of the
type MTD_UBIVOLUME.

Fixes: 2ba3d76a1e ("UBI: make gluebi a separate module")
Link: https://bugzilla.kernel.org/show_bug.cgi?id=217992 [1]
Link: https://lore.kernel.org/lkml/441107100.23734.1697904580252.JavaMail.zimbra@nod.at/ [2]
Signed-off-by: ZhaoLong Wang <wangzhaolong1@huawei.com>
Reviewed-by: Zhihao Cheng <chengzhihao1@huawei.com>
Acked-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20231220024619.2138625-1-wangzhaolong1@huawei.com
This commit is contained in:
ZhaoLong Wang 2023-12-20 10:46:19 +08:00 committed by Miquel Raynal
parent b9e824f995
commit a43bdc376d
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/mtd/mtd_blkdevs.c
View File

@ -463,7 +463,7 @@ static void blktrans_notify_add(struct mtd_info *mtd)
{ {
struct mtd_blktrans_ops *tr; struct mtd_blktrans_ops *tr;
if (mtd->type == MTD_ABSENT) if (mtd->type == MTD_ABSENT || mtd->type == MTD_UBIVOLUME)
return; return;
list_for_each_entry(tr, &blktrans_majors, list) list_for_each_entry(tr, &blktrans_majors, list)
@ -503,7 +503,7 @@ int register_mtd_blktrans(struct mtd_blktrans_ops *tr)
mutex_lock(&mtd_table_mutex); mutex_lock(&mtd_table_mutex);
list_add(&tr->list, &blktrans_majors); list_add(&tr->list, &blktrans_majors);
mtd_for_each_device(mtd) mtd_for_each_device(mtd)
if (mtd->type != MTD_ABSENT) if (mtd->type != MTD_ABSENT && mtd->type != MTD_UBIVOLUME)
tr->add_mtd(tr, mtd); tr->add_mtd(tr, mtd);
mutex_unlock(&mtd_table_mutex); mutex_unlock(&mtd_table_mutex);
return 0; return 0;