| Message ID | 20230214093801.1267044-1-harshit.m.mogalapalli@oracle.com |
|---|---|
| State | Accepted |
| Delegated to: | Richard Weinberger |
| Headers | show |
| Series | [linux-next] ubi: block: Fix a possible use-after-free bug in ubiblock_create() | expand |
----- Ursprüngliche Mail ----- > Von: "harshit m mogalapalli" <harshit.m.mogalapalli@oracle.com> > Smatch warns: > drivers/mtd/ubi/block.c:438 ubiblock_create() > warn: '&dev->list' not removed from list > > 'dev' is freed in 'out_free_dev:, but it is still on the list. > > To fix this, delete the list item before freeing. > > Fixes: 91cc8fbcc8c7 ("ubi: block: set BLK_MQ_F_BLOCKING") > Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com> > --- > Found by static analysis(smatch). Only Compile tested. > --- > drivers/mtd/ubi/block.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/drivers/mtd/ubi/block.c b/drivers/mtd/ubi/block.c > index f5d036203fe7..763704c8d05c 100644 > --- a/drivers/mtd/ubi/block.c > +++ b/drivers/mtd/ubi/block.c > @@ -429,6 +429,7 @@ int ubiblock_create(struct ubi_volume_info *vi) > return 0; > > out_remove_minor: > + list_del(&dev->list); > idr_remove(&ubiblock_minor_idr, gd->first_minor); > out_cleanup_disk: > put_disk(dev->gd); Good catch! Thanks, //richard
On Tue, Feb 14, 2023 at 01:38:01AM -0800, Harshit Mogalapalli wrote: > Smatch warns: > drivers/mtd/ubi/block.c:438 ubiblock_create() > warn: '&dev->list' not removed from list > > 'dev' is freed in 'out_free_dev:, but it is still on the list. > > To fix this, delete the list item before freeing. > > Fixes: 91cc8fbcc8c7 ("ubi: block: set BLK_MQ_F_BLOCKING") > Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com> Thanks, this looks good: Reviewed-by: Christoph Hellwig <hch@lst.de>
diff --git a/drivers/mtd/ubi/block.c b/drivers/mtd/ubi/block.c index f5d036203fe7..763704c8d05c 100644 --- a/drivers/mtd/ubi/block.c +++ b/drivers/mtd/ubi/block.c @@ -429,6 +429,7 @@ int ubiblock_create(struct ubi_volume_info *vi) return 0; out_remove_minor: + list_del(&dev->list); idr_remove(&ubiblock_minor_idr, gd->first_minor); out_cleanup_disk: put_disk(dev->gd);
Smatch warns: drivers/mtd/ubi/block.c:438 ubiblock_create() warn: '&dev->list' not removed from list 'dev' is freed in 'out_free_dev:, but it is still on the list. To fix this, delete the list item before freeing. Fixes: 91cc8fbcc8c7 ("ubi: block: set BLK_MQ_F_BLOCKING") Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com> --- Found by static analysis(smatch). Only Compile tested. --- drivers/mtd/ubi/block.c | 1 + 1 file changed, 1 insertion(+)