Commit 8fcf2d01 authored by Harshit Mogalapalli's avatar Harshit Mogalapalli Committed by Richard Weinberger
Browse files

ubi: block: Fix a possible use-after-free bug in ubiblock_create() 



Smatch warns:
	drivers/mtd/ubi/block.c:438 ubiblock_create()
	warn: '&dev->list' not removed from list

'dev' is freed in 'out_free_dev:, but it is still on the list.

To fix this, delete the list item before freeing.

Fixes: 91cc8fbc ("ubi: block: set BLK_MQ_F_BLOCKING")
Signed-off-by: default avatarHarshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
Signed-off-by: default avatarRichard Weinberger <richard@nod.at>
parent 22d74bc2

drivers/mtd/ubi/block.c

+1 −0
Original line number Diff line number Diff line
@@ -429,6 +429,7 @@ int ubiblock_create(struct ubi_volume_info *vi) 
	return 0;



out_remove_minor:

	list_del(&dev->list);

	idr_remove(&ubiblock_minor_idr, gd->first_minor);

out_cleanup_disk:

	put_disk(dev->gd);