diff options
| author | Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com> | 2023-02-14 01:38:01 -0800 |
|---|---|---|
| committer | Richard Weinberger <richard@nod.at> | 2023-02-14 15:17:55 +0100 |
| commit | 8fcf2d012c8641c18adcd139dba6a1e556338d36 (patch) | |
| tree | 9e647dd64cbd35b127f582963bd65d99ca6e759b /drivers/mtd/ubi | |
| parent | 22d74bc26bbfde150f602b2a6e93fb11df30ce0b (diff) | |
| download | linux-stable-8fcf2d012c8641c18adcd139dba6a1e556338d36.tar.gz linux-stable-8fcf2d012c8641c18adcd139dba6a1e556338d36.tar.bz2 linux-stable-8fcf2d012c8641c18adcd139dba6a1e556338d36.zip | |
ubi: block: Fix a possible use-after-free bug in ubiblock_create()
Smatch warns:
drivers/mtd/ubi/block.c:438 ubiblock_create()
warn: '&dev->list' not removed from list
'dev' is freed in 'out_free_dev:, but it is still on the list.
To fix this, delete the list item before freeing.
Fixes: 91cc8fbcc8c7 ("ubi: block: set BLK_MQ_F_BLOCKING")
Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Richard Weinberger <richard@nod.at>
Diffstat (limited to 'drivers/mtd/ubi')
| -rw-r--r-- | drivers/mtd/ubi/block.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/mtd/ubi/block.c b/drivers/mtd/ubi/block.c index 6a9eb2c860b5..1de87062c67b 100644 --- a/drivers/mtd/ubi/block.c +++ b/drivers/mtd/ubi/block.c @@ -429,6 +429,7 @@ int ubiblock_create(struct ubi_volume_info *vi) return 0; out_remove_minor: + list_del(&dev->list); idr_remove(&ubiblock_minor_idr, gd->first_minor); out_cleanup_disk: put_disk(dev->gd); |