[PATCH v2] mmc: fix use-after-free issue

[PATCH v2] mmc: fix use-after-free issue

[彭浩(Richard)]

 The data structure member “rpmb->md” was passed to a call of
 the function “mmc_blk_put” after a call of the function “put_device”.
 Reorder these function calls to keep the data accesses consistent.

Fixes: 1c87f7357849 ("mmc: block: Fix bug when removing RPMB chardev ")
Signed-off-by: Peng Hao <richard.peng@oppo.com>
---
 drivers/mmc/core/block.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
index 8499b56..e6e025c 100644
--- a/drivers/mmc/core/block.c
+++ b/drivers/mmc/core/block.c
@@ -2483,8 +2483,8 @@ static int mmc_rpmb_chrdev_release(struct inode *inode, struct file *filp)
 struct mmc_rpmb_data *rpmb = container_of(inode->i_cdev,
   struct mmc_rpmb_data, chrdev);

-put_device(&rpmb->dev);
 mmc_blk_put(rpmb->md);
+put_device(&rpmb->dev);

 return 0;
 }
--
2.7.4
________________________________
OPPO

本电子邮件及其附件含有OPPO公司的保密信息，仅限于邮件指明的收件人使用（包含个人及群组）。禁止任何人在未经授权的情况下以任何形式使用。如果您错收了本邮件，请立即以电子邮件通知发件人并删除本邮件及其附件。

This e-mail and its attachments contain confidential information from OPPO, which is intended only for the person or entity whose address is listed above. Any use of the information contained herein in any way (including, but not limited to, total or partial disclosure, reproduction, or dissemination) by persons other than the intended recipient(s) is prohibited. If you receive this e-mail in error, please notify the sender by phone or email immediately and delete it!

Re: [PATCH v2] mmc: fix use-after-free issue

[Ulf Hansson]

On Fri, 22 May 2020 at 11:29, 彭浩(Richard) <richard.peng@oppo.com> wrote:
>
>  The data structure member “rpmb->md” was passed to a call of
>  the function “mmc_blk_put” after a call of the function “put_device”.
>  Reorder these function calls to keep the data accesses consistent.
>
> Fixes: 1c87f7357849 ("mmc: block: Fix bug when removing RPMB chardev ")
> Signed-off-by: Peng Hao <richard.peng@oppo.com>

I downloaded the patch from patchwork, but it seems like it got
mangled somehow. Perhaps you can try to download it from patchwork and
run checkpatch on it to see if it works for you? Otherwise the problem
may be at my side.

In any case, I manually fixed it up this time. So, applied for fixes
and by adding a stable tag, thanks!

Kind regards
Uffe



> ---
>  drivers/mmc/core/block.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
> index 8499b56..e6e025c 100644
> --- a/drivers/mmc/core/block.c
> +++ b/drivers/mmc/core/block.c
> @@ -2483,8 +2483,8 @@ static int mmc_rpmb_chrdev_release(struct inode *inode, struct file *filp)
>  struct mmc_rpmb_data *rpmb = container_of(inode->i_cdev,
>    struct mmc_rpmb_data, chrdev);
>
> -put_device(&rpmb->dev);
>  mmc_blk_put(rpmb->md);
> +put_device(&rpmb->dev);
>
>  return 0;
>  }
> --
> 2.7.4
> ________________________________
> OPPO
>
> 本电子邮件及其附件含有OPPO公司的保密信息，仅限于邮件指明的收件人使用（包含个人及群组）。禁止任何人在未经授权的情况下以任何形式使用。如果您错收了本邮件，请立即以电子邮件通知发件人并删除本邮件及其附件。
>
> This e-mail and its attachments contain confidential information from OPPO, which is intended only for the person or entity whose address is listed above. Any use of the information contained herein in any way (including, but not limited to, total or partial disclosure, reproduction, or dissemination) by persons other than the intended recipient(s) is prohibited. If you receive this e-mail in error, please notify the sender by phone or email immediately and delete it!