[PATCH linux-next] ubi: block: Fix a possible use-after-free bug in ubiblock_create()

From: Harshit Mogalapalli
Date: Tue Feb 14 2023 - 04:38:34 EST


Smatch warns:
drivers/mtd/ubi/block.c:438 ubiblock_create()
warn: '&dev->list' not removed from list

'dev' is freed in 'out_free_dev:, but it is still on the list.

To fix this, delete the list item before freeing.

Fixes: 91cc8fbcc8c7 ("ubi: block: set BLK_MQ_F_BLOCKING")
Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@xxxxxxxxxx>
---
Found by static analysis(smatch). Only Compile tested.
---
drivers/mtd/ubi/block.c | 1 +
1 file changed, 1 insertion(+)

diff --git a/drivers/mtd/ubi/block.c b/drivers/mtd/ubi/block.c
index f5d036203fe7..763704c8d05c 100644
--- a/drivers/mtd/ubi/block.c
+++ b/drivers/mtd/ubi/block.c
@@ -429,6 +429,7 @@ int ubiblock_create(struct ubi_volume_info *vi)
return 0;

out_remove_minor:
+ list_del(&dev->list);
idr_remove(&ubiblock_minor_idr, gd->first_minor);
out_cleanup_disk:
put_disk(dev->gd);
--
2.38.1