disk/loopback: Reference tracking for the loopback
authorB Horn <b@horn.uk>
Sun, 12 May 2024 02:26:19 +0000 (03:26 +0100)
committerFelix Zielcke <fzielcke@z-51.de>
Thu, 3 Jul 2025 16:35:51 +0000 (18:35 +0200)
commit5eb8070ebcecb2119241e834dd388e8f8a08af39
treea21b50b4890a1330ef425b02f0f59fe49048698e
parent6f83cc4c62482ab738a245252eb7973961d700a7
disk/loopback: Reference tracking for the loopback

It was possible to delete a loopback while there were still references
to it. This led to an exploitable use-after-free.

Fixed by implementing a reference counting in the grub_loopback struct.

Reported-by: B Horn <b@horn.uk>
Signed-off-by: B Horn <b@horn.uk>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
Gbp-Pq: Topic cve-2025-jan
Gbp-Pq: Name disk-loopback-Reference-tracking-for-the-loopback.patch
grub-core/disk/loopback.c
include/grub/err.h