ubi: block: Fix a possible use-after-free bug in ubiblock_create()
authorHarshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Tue, 14 Feb 2023 09:38:01 +0000 (01:38 -0800)
committerRichard Weinberger <richard@nod.at>
Tue, 14 Feb 2023 14:17:55 +0000 (15:17 +0100)
commit8fcf2d012c8641c18adcd139dba6a1e556338d36
tree9e647dd64cbd35b127f582963bd65d99ca6e759b
parent22d74bc26bbfde150f602b2a6e93fb11df30ce0b
ubi: block: Fix a possible use-after-free bug in ubiblock_create()

Smatch warns:
drivers/mtd/ubi/block.c:438 ubiblock_create()
warn: '&dev->list' not removed from list

'dev' is freed in 'out_free_dev:, but it is still on the list.

To fix this, delete the list item before freeing.

Fixes: 91cc8fbcc8c7 ("ubi: block: set BLK_MQ_F_BLOCKING")
Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Richard Weinberger <richard@nod.at>
drivers/mtd/ubi/block.c