]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
ubi: Revert "ubi: wl: Close down wear-leveling before nand is suspended"
authorZhihao Cheng <chengzhihao1@huawei.com>
Sat, 14 Dec 2024 11:01:53 +0000 (19:01 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sat, 8 Feb 2025 09:02:08 +0000 (10:02 +0100)
commitcfc85738da7fd4598393387182783ff0cd090b69
tree1061121cf61627be24d979d163d6c47c97c97666
parent6d89398505480c1b83c716665ac1929d04ef0fac
ubi: Revert "ubi: wl: Close down wear-leveling before nand is suspended"

[ Upstream commit 844c6fdc13cf3d9d251533631988a58f8356a8c8 ]

Commit 5580cdae05ae ("ubi: wl: Close down wear-leveling before nand is
suspended") added a reboot notification in UBI layer to shutdown the
wear-leveling subsystem, which imported an UAF problem[1]. Besides that,
the method also brings other potential UAF problems, for example:
       reboot             kworker
 ubi_wl_reboot_notifier
  ubi_wl_close
   ubi_fastmap_close
    kfree(ubi->fm)
                     update_fastmap_work_fn
      ubi_update_fastmap
       old_fm = ubi->fm
       if (old_fm && old_fm->e[i]) // UAF!

Actually, the problem fixed by commit 5580cdae05ae ("ubi: wl: Close down
wear-leveling before nand is suspended") has been solved by commit
8cba323437a4 ("mtd: rawnand: protect access to rawnand devices while in
suspend"), which was discussed in [2]. So we can revert the commit
5580cdae05ae ("ubi: wl: Close down wear-leveling before nand is
suspended") directly.

[1] https://lore.kernel.org/linux-mtd/20241208175211.9406-2-dennis.lamerice@gmail.com/
[2] https://lore.kernel.org/all/9bf76f5d-12a4-46ff-90d4-4a7f0f47c381@axis.com/

Fixes: 5580cdae05ae ("ubi: wl: Close down wear-leveling before nand is suspended")
Reported-by: Dennis Lam <dennis.lamerice@gmail.com>
Closes: https://lore.kernel.org/linux-mtd/20241208175211.9406-2-dennis.lamerice@gmail.com/
Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
Acked-by: MÃ¥rten Lindahl <marten.lindahl@axis.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/mtd/ubi/ubi.h
drivers/mtd/ubi/wl.c