)]}'
{
  "commit": "d07cec9c238ae8fc6c1a9f3f5d30a2f8ec6cdc71",
  "tree": "5b8022c4e2075eb26ae2bbdbf775f6c577673344",
  "parents": [
    "d81efd66106c03771ffc8637855a6ec24caa6350"
  ],
  "author": {
    "name": "ZhaoLong Wang",
    "email": "wangzhaolong1@huawei.com",
    "time": "Thu Sep 21 10:01:42 2023 +0800"
  },
  "committer": {
    "name": "Richard Weinberger",
    "email": "richard@nod.at",
    "time": "Sat Oct 28 23:18:39 2023 +0200"
  },
  "message": "ubi: block: Fix use-after-free in ubiblock_cleanup\n\nThe following BUG is reported when a ubiblock is removed:\n\n \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n BUG: KASAN: slab-use-after-free in ubiblock_cleanup+0x88/0xa0 [ubi]\n Read of size 4 at addr ffff88810c8f3804 by task ubiblock/1716\n\n CPU: 5 PID: 1716 Comm: ubiblock Not tainted 6.6.0-rc2+ #135\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190727_073836-buildvm-ppc64le-16.ppc.fedoraproject.org-3.fc31 04/01/2014\n Call Trace:\n  \u003cTASK\u003e\n  dump_stack_lvl+0x37/0x50\n  print_report+0xd0/0x620\n  kasan_report+0xb6/0xf0\n  ubiblock_cleanup+0x88/0xa0 [ubi]\n  ubiblock_remove+0x121/0x190 [ubi]\n  vol_cdev_ioctl+0x355/0x630 [ubi]\n  __x64_sys_ioctl+0xc7/0x100\n  do_syscall_64+0x3f/0x90\n  entry_SYSCALL_64_after_hwframe+0x6e/0xd8\n RIP: 0033:0x7f08d7445577\n Code: b3 66 90 48 8b 05 11 89 2c 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 b8 10 00 00 00 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 8b 0d e1 8\n RSP: 002b:00007ffde05a3018 EFLAGS: 00000206 ORIG_RAX: 0000000000000010\n RAX: ffffffffffffffda RBX: 00000000ffffffff RCX: 00007f08d7445577\n RDX: 0000000000000000 RSI: 0000000000004f08 RDI: 0000000000000003\n RBP: 0000000000816010 R08: 00000000008163a7 R09: 0000000000000000\n R10: 0000000000000003 R11: 0000000000000206 R12: 0000000000000003\n R13: 00007ffde05a3130 R14: 0000000000000000 R15: 0000000000000000\n  \u003c/TASK\u003e\n\n Allocated by task 1715:\n  kasan_save_stack+0x22/0x50\n  kasan_set_track+0x25/0x30\n  __kasan_kmalloc+0x7f/0x90\n  __alloc_disk_node+0x40/0x2b0\n  __blk_mq_alloc_disk+0x3e/0xb0\n  ubiblock_create+0x2ba/0x620 [ubi]\n  vol_cdev_ioctl+0x581/0x630 [ubi]\n  __x64_sys_ioctl+0xc7/0x100\n  do_syscall_64+0x3f/0x90\n  entry_SYSCALL_64_after_hwframe+0x6e/0xd8\n\n Freed by task 0:\n  kasan_save_stack+0x22/0x50\n  kasan_set_track+0x25/0x30\n  kasan_save_free_info+0x2b/0x50\n  __kasan_slab_free+0x10e/0x190\n  __kmem_cache_free+0x96/0x220\n  bdev_free_inode+0xa4/0xf0\n  rcu_core+0x496/0xec0\n  __do_softirq+0xeb/0x384\n\n The buggy address belongs to the object at ffff88810c8f3800\n  which belongs to the cache kmalloc-1k of size 1024\n The buggy address is located 4 bytes inside of\n  freed 1024-byte region [ffff88810c8f3800, ffff88810c8f3c00)\n\n The buggy address belongs to the physical page:\n page:00000000d03de848 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10c8f0\n head:00000000d03de848 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0\n flags: 0x200000000000840(slab|head|node\u003d0|zone\u003d2)\n page_type: 0xffffffff()\n raw: 0200000000000840 ffff888100042dc0 ffffea0004244400 dead000000000002\n raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000\n page dumped because: kasan: bad access detected\n\n Memory state around the buggy address:\n  ffff88810c8f3700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n  ffff88810c8f3780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n \u003effff88810c8f3800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n                    ^\n  ffff88810c8f3880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n  ffff88810c8f3900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nFix it by using a local variable to record the gendisk ID.\n\nFixes: 77567b25ab9f (\"ubi: use blk_mq_alloc_disk and blk_cleanup_disk\")\nSigned-off-by: ZhaoLong Wang \u003cwangzhaolong1@huawei.com\u003e\nReviewed-by: Zhihao Cheng \u003cchengzhihao1@huawei.com\u003e\nSigned-off-by: Richard Weinberger \u003crichard@nod.at\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "437c5b83ffe51347b40841edbc7409ef91c0bd83",
      "old_mode": 33188,
      "old_path": "drivers/mtd/ubi/block.c",
      "new_id": "309a42aeaa4cdbbab017252175b18748c91d0cf4",
      "new_mode": 33188,
      "new_path": "drivers/mtd/ubi/block.c"
    }
  ]
}