diff mbox series

[5.4,083/142] mmc: block: Fix use-after-free issue for rpmb

Message ID	20200601174046.549387147@linuxfoundation.org
State	Superseded
Headers	show Return-Path: <SRS0=Ycwd=7O=vger.kernel.org=stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Peng Hao <richard.peng@oppo.com>, Ulf Hansson <ulf.hansson@linaro.org>, Sasha Levin <sashal@kernel.org> Subject: [PATCH 5.4 083/142] mmc: block: Fix use-after-free issue for rpmb Date: Mon, 1 Jun 2020 19:54:01 +0200 Message-Id: <20200601174046.549387147@linuxfoundation.org> In-Reply-To: <20200601174037.904070960@linuxfoundation.org> References: <20200601174037.904070960@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org Precedence: bulk
Series	None \| expand [5.4,002/142] dpaa_eth: fix usage as DSA master, try 3 [5.4,004/142] net: dsa: mt7530: fix roaming from DSA user ports [5.4,006/142] __netif_receive_skb_core: pass skb by reference [5.4,007/142] net: inet_csk: Fix so_reuseport bind-address cache in tb->fast* [5.4,011/142] net: nlmsg_cancel() if put fails for nhmsg [5.4,013/142] net: revert "net: get rid of an signed integer overflow in ip_idents_reserve()" [5.4,014/142] net sched: fix reporting the first-time use timestamp [5.4,018/142] sctp: Dont add the shutdown timer if its already been added [5.4,020/142] tipc: block BH before using dst_cache [5.4,021/142] net/mlx5e: kTLS, Destroy key object after destroying the TIS [5.4,024/142] net/mlx5e: Update netdev txq on completions during closure [5.4,025/142] net/mlx5: Fix error flow in case of function_setup failure [5.4,026/142] net/mlx5: Annotate mutex destroy for root ns [5.4,028/142] net/tls: free record only on encryption error [5.4,031/142] mlxsw: spectrum: Fix use-after-free of split/unsplit/type_set in case reload fails [5.4,033/142] ARM: dts: rockchip: fix phy nodename for rk3229-xms6 [5.4,034/142] arm64: dts: rockchip: fix status for &gmac2phy in rk3328-evb.dts [5.4,037/142] ARM: dts: rockchip: fix pinctrl sub nodename for spi in rk322x.dtsi [5.4,040/142] net: microchip: encx24j600: add missed kthread_stop [5.4,041/142] gfs2: move privileged user check to gfs2_quota_lock_check [5.4,044/142] drm/amdgpu: drop unnecessary cancel_delayed_work_sync on PG ungate [5.4,048/142] usb: dwc3: pci: Enable extcon driver for Intel Merrifield [5.4,049/142] usb: phy: twl6030-usb: Fix a resource leak in an error handling path in twl6030_usb... [5.4,051/142] net: freescale: select CONFIG_FIXED_PHY where needed [5.4,053/142] riscv: stacktrace: Fix undefined reference to `walk_stackframe [5.4,054/142] clk: ti: am33xx: fix RTC clock parent [5.4,057/142] csky: Fixup remove duplicate irq_disable [5.4,060/142] csky: Fixup raw_copy_from_user() [5.4,061/142] samples: bpf: Fix build error [5.4,062/142] drivers: net: hamradio: Fix suspicious RCU usage warning in bpqether.c [5.4,063/142] Input: usbtouchscreen - add support for BonXeon TP [5.4,065/142] Input: evdev - call input_flush_device() on release(), not flush() [5.4,066/142] Input: xpad - add custom init packet for Xbox One S controllers [5.4,068/142] Input: i8042 - add ThinkPad S230u to i8042 reset list [5.4,069/142] Input: synaptics-rmi4 - really fix attn_data use-after-free [5.4,071/142] ARM: 8970/1: decompressor: increase tag size [5.4,075/142] gpio: exar: Fix bad handling for ida_simple_get error path [5.4,076/142] arm64: dts: mt8173: fix vcodec-enc clock [5.4,080/142] ARM: dts/imx6q-bx50v3: Set display interface clock parents [5.4,081/142] ARM: dts: bcm2835-rpi-zero-w: Fix led polarity [5.4,083/142] mmc: block: Fix use-after-free issue for rpmb [5.4,086/142] RDMA/pvrdma: Fix missing pci disable in pvrdma_pci_probe() [5.4,087/142] ALSA: hwdep: fix a left shifting 1 by 31 UB bug [5.4,090/142] exec: Always set cap_ambient in cap_bprm_set_creds [5.4,092/142] ALSA: usb-audio: Quirks for Gigabyte TRX40 Aorus Master onboard audio [5.4,094/142] libceph: ignore pool overlay and cache logic on redirects [5.4,097/142] drm/amd/display: drop cursor position check in atomic test [5.4,101/142] fs/binfmt_elf.c: allocate initialized memory in fill_thread_core_info() [5.4,102/142] include/asm-generic/topology.h: guard cpumask_of_node() macro argument [5.4,106/142] parisc: Fix kernel panic in mem_init() [5.4,108/142] x86/syscalls: Revert "x86/syscalls: Make __X32_SYSCALL_BIT be unsigned long" [5.4,110/142] x86/dma: Fix max PFN arithmetic overflow on 32 bit systems [5.4,112/142] xfrm: allow to accept packets with ipv6 NEXTHDR_HOP in xfrm_input [5.4,115/142] xfrm: call xfrm_output_gso when inner_protocol is set in xfrm_output [5.4,116/142] xfrm interface: fix oops when deleting a x-netns interface [5.4,118/142] xfrm: fix a NULL-ptr deref in xfrm_local_error [5.4,119/142] xfrm: fix error in comment [5.4,121/142] netfilter: nft_reject_bridge: enable reject with bridge vlan [5.4,123/142] netfilter: conntrack: make conntrack userspace helpers work again [5.4,124/142] netfilter: nfnetlink_cthelper: unbreak userspace helper support [5.4,127/142] bnxt_en: Fix accumulation of bp->net_stats_prev. [5.4,128/142] ieee80211: Fix incorrect mask for default PE duration [5.4,131/142] crypto: chelsio/chtls: properly set tp->lsndtime [5.4,133/142] nexthops: dont modify published nexthop groups [5.4,134/142] nexthop: Expand nexthop_is_multipath in a few places [5.4,137/142] bonding: Fix reference count leak in bond_sysfs_slave_add. [5.4,139/142] netfilter: conntrack: comparison of unsigned in cthelper confirmation [5.4,141/142] netfilter: nf_conntrack_pptp: fix compilation warning with W=1 build

Commit Message

Greg KH June 1, 2020, 5:54 p.m. UTC

From: Peng Hao <richard.peng@oppo.com>

[ Upstream commit 202500d21654874aa03243e91f96de153ec61860 ]

The data structure member “rpmb->md” was passed to a call of the function
“mmc_blk_put” after a call of the function “put_device”. Reorder these
function calls to keep the data accesses consistent.

Fixes: 1c87f7357849 ("mmc: block: Fix bug when removing RPMB chardev ")
Signed-off-by: Peng Hao <richard.peng@oppo.com>
Cc: stable@vger.kernel.org
[Uffe: Fixed up mangled patch and updated commit message]
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mmc/core/block.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff mbox series

Patch

diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
index 9d01b5dca519..7f480c6b1981 100644
--- a/drivers/mmc/core/block.c
+++ b/drivers/mmc/core/block.c
@@ -2475,8 +2475,8 @@  static int mmc_rpmb_chrdev_release(struct inode *inode, struct file *filp)
 	struct mmc_rpmb_data *rpmb = container_of(inode->i_cdev,
 						  struct mmc_rpmb_data, chrdev);
 
-	put_device(&rpmb->dev);
 	mmc_blk_put(rpmb->md);
+	put_device(&rpmb->dev);
 
 	return 0;
 }