unimore/kernel-hacking-2024-linux-steffo
unimore/kernel-hacking-2024-linux-steffo
1
Fork 0
Code Pull requests 5 Wiki Activity

ubi: block: Fix a possible use-after-free bug in ubiblock_create()

Browse source 
Smatch warns:
	drivers/mtd/ubi/block.c:438 ubiblock_create()
	warn: '&dev->list' not removed from list

'dev' is freed in 'out_free_dev:, but it is still on the list.

To fix this, delete the list item before freeing.

Fixes: 91cc8fbcc8 ("ubi: block: set BLK_MQ_F_BLOCKING")
Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Richard Weinberger <richard@nod.at>
This commit is contained in:
Harshit Mogalapalli 2023-02-14 01:38:01 -08:00 committed by Richard Weinberger
parent 22d74bc26b
commit 8fcf2d012c
1 changed files with 1 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
drivers/mtd/ubi/block.c
View file

@ -429,6 +429,7 @@ int ubiblock_create(struct ubi_volume_info *vi)
return 0; return 0;
out_remove_minor: out_remove_minor:
list_del(&dev->list);
idr_remove(&ubiblock_minor_idr, gd->first_minor); idr_remove(&ubiblock_minor_idr, gd->first_minor);
out_cleanup_disk: out_cleanup_disk:
put_disk(dev->gd); put_disk(dev->gd);