Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
dax: Fix potential uaf in __dax_pmem_probe()
__dax_pmem_probe() allocates a memory chunk from dax_region with alloc_dax_region(). alloc_dax_region() increases the refcount for dax_region and uses devm_add_action_or_reset() to make the parent dev manage the dax_region. The dax_region will be used if the parent dev is destroyed. Then the function calls devm_create_dev_dax() to make child dev_dax instances own the lifetime of the dax_region. devm_create_dev_dax() calls devm_add_action_or_reset(dax_region->dev, unregister_dev_dax, dev); to make the child dev_dax manage the dax_region and register the destroy function "unregister_dev_dax".The devm_create_dev_dax() increases the refcount for dax_region when the function is successfully executed. But when some error occurs, devm_create_dev_dax() may return ERR_PTR before increasing the refcount for dax_region. In these cases, the call for dax_region_put() will decrease the ref count for dax_region and trigger dax_region_free(), which will execute kfree(dax_region). When the parent dev is destroyed, the registered destroy function "unregister_dev_dax" will be triggered and calls dax_region_free(), which will use the freed dax_region, leading to a use after free bug. We should check the return value of devm_create_dev_dax(). If it returns ERR_PTR, we should return this function with ERR_PTR. Signed-off-by: Jianglei Nie <niejianglei2021@163.com>
- Loading branch information