Re: [PATCH] aros/hostdisk: Fix use-after-free bug during MsgPort deletion

On 2025-12-08 22:30, [email protected] wrote:
> Message: 1
> Date: Mon,  8 Dec 2025 15:51:29 +0530
> From: Srish Srinivasan <[email protected]>
> To: [email protected]
> Cc: [email protected], [email protected],
> 	[email protected], [email protected]
> Subject: [PATCH] aros/hostdisk: Fix use-after-free bug during MsgPort
> 	deletion
> Message-ID: <[email protected]>
> 
> Inside grub_util_fd_open, a failure while creating an IO
> request or opening a device frees ret (the fd) before its
> MsgPort is deleted. This leads to a use-after-free scenario.
> 
> Fix this by freeing ret after its MsgPort has been deleted.

Hi Srish,

Suggestion on commit message:

"In function grub_util_fd_open(), if creating an I/O request or opening 
a device fails. 'ret' (the file descriptor) will be freed before its 
associated MsgPort is deleted, resulting in a use-after-free condition.

Fixing this issue by freeing 'ret' after its associated MsgPort has been 
deleted."

> Signed-off-by: Srish Srinivasan <[email protected]>

Reviewed-by: Avnish Chouhan <[email protected]>

Regards,
Avnish Chouhan

> ---
>  grub-core/osdep/aros/hostdisk.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/grub-core/osdep/aros/hostdisk.c 
> b/grub-core/osdep/aros/hostdisk.c
> index 08723bd45..c75474933 100644
> --- a/grub-core/osdep/aros/hostdisk.c
> +++ b/grub-core/osdep/aros/hostdisk.c
> @@ -207,8 +207,8 @@ grub_util_fd_open (const char *dev, int flg)
>  						 sizeof(struct IOExtTD));
>    if (!ret->ioreq)
>      {
> -      free (ret);
>        DeleteMsgPort (ret->mp);
> +      free (ret);
>        return NULL;
>      }
> 
> @@ -225,9 +225,9 @@ grub_util_fd_open (const char *dev, int flg)
>    if (OpenDevice ((unsigned char *) tmp, unit,
>  		  (struct IORequest *) ret->ioreq, flags))
>      {
> -      free (tmp);
> -      free (ret);
>        DeleteMsgPort (ret->mp);
> +      free (ret);
> +      free (tmp);
>        return NULL;
>      }
>    free (tmp);
> --
> 2.43.0

_______________________________________________
Grub-devel mailing list
[email protected]
https://lists.gnu.org/mailman/listinfo/grub-devel