]> www.infradead.org Git - users/jedix/linux-maple.git/commit
ubi: Revert "ubi: wl: Close down wear-leveling before nand is suspended"
authorZhihao Cheng <chengzhihao1@huawei.com>
Sat, 14 Dec 2024 11:01:53 +0000 (19:01 +0800)
committerRichard Weinberger <richard@nod.at>
Sat, 18 Jan 2025 14:28:19 +0000 (15:28 +0100)
commit844c6fdc13cf3d9d251533631988a58f8356a8c8
tree6095c77d7923eb3748f2bb015a292a3870fc25b4
parent404de7abc05758254ad57d9501d30427d9c57417
ubi: Revert "ubi: wl: Close down wear-leveling before nand is suspended"

Commit 5580cdae05ae ("ubi: wl: Close down wear-leveling before nand is
suspended") added a reboot notification in UBI layer to shutdown the
wear-leveling subsystem, which imported an UAF problem[1]. Besides that,
the method also brings other potential UAF problems, for example:
       reboot             kworker
 ubi_wl_reboot_notifier
  ubi_wl_close
   ubi_fastmap_close
    kfree(ubi->fm)
                     update_fastmap_work_fn
      ubi_update_fastmap
       old_fm = ubi->fm
       if (old_fm && old_fm->e[i]) // UAF!

Actually, the problem fixed by commit 5580cdae05ae ("ubi: wl: Close down
wear-leveling before nand is suspended") has been solved by commit
8cba323437a4 ("mtd: rawnand: protect access to rawnand devices while in
suspend"), which was discussed in [2]. So we can revert the commit
5580cdae05ae ("ubi: wl: Close down wear-leveling before nand is
suspended") directly.

[1] https://lore.kernel.org/linux-mtd/20241208175211.9406-2-dennis.lamerice@gmail.com/
[2] https://lore.kernel.org/all/9bf76f5d-12a4-46ff-90d4-4a7f0f47c381@axis.com/

Fixes: 5580cdae05ae ("ubi: wl: Close down wear-leveling before nand is suspended")
Reported-by: Dennis Lam <dennis.lamerice@gmail.com>
Closes: https://lore.kernel.org/linux-mtd/20241208175211.9406-2-dennis.lamerice@gmail.com/
Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
Acked-by: MÃ¥rten Lindahl <marten.lindahl@axis.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
drivers/mtd/ubi/ubi.h
drivers/mtd/ubi/wl.c