possible use-after-free in drivers/mtd/ubi/wl.c: erase_worker

[Josh Boyer]

On Tue, Jan 3, 2012 at 6:34 PM, Emese Revfy <re.emese at gmail.com> wrote:
> Hi,
>
> I think I found a potential problem in drivers/mtd/ubi/wl.c in
> erase_worker():
>
> 1050         ubi_err("failed to erase PEB %d, error %d", pnum, err);
> 1051         kfree(wl_wrk);
> 1052         kmem_cache_free(ubi_wl_entry_slab, e);
> 1053
> 1054         if (err == -EINTR || err == -ENOMEM || err == -EAGAIN ||
> 1055             err == -EBUSY) {
> 1056                 int err1;
> 1057
> 1058                 /* Re-schedule the LEB for erasure */
> 1059                 err1 = schedule_erase(ubi, e, 0);
>
> The pointer e is freed at line 1052 (kmem_cache_free), but
> later it is passed to schedule_erase which will eventually call
> erase_worker where it will be dereferenced and/or freed again.

Yes.  That does seem to be a problem.  Care to create a patch that solves this
by deferring the frees until after the err variable is checked?

josh