* [PATCH linux-next] ubi: block: Fix a possible use-after-free bug in ubiblock_create()
@ 2023-02-14 9:38 ` Harshit Mogalapalli
0 siblings, 0 replies; 6+ messages in thread
From: Harshit Mogalapalli @ 2023-02-14 9:38 UTC (permalink / raw)
Cc: harshit.m.mogalapalli, error27, hch, Harshit Mogalapalli,
Richard Weinberger, Miquel Raynal, Vignesh Raghavendra, linux-mtd,
linux-kernel
Smatch warns:
drivers/mtd/ubi/block.c:438 ubiblock_create()
warn: '&dev->list' not removed from list
'dev' is freed in 'out_free_dev:, but it is still on the list.
To fix this, delete the list item before freeing.
Fixes: 91cc8fbcc8c7 ("ubi: block: set BLK_MQ_F_BLOCKING")
Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
---
Found by static analysis(smatch). Only Compile tested.
---
drivers/mtd/ubi/block.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/mtd/ubi/block.c b/drivers/mtd/ubi/block.c
index f5d036203fe7..763704c8d05c 100644
--- a/drivers/mtd/ubi/block.c
+++ b/drivers/mtd/ubi/block.c
@@ -429,6 +429,7 @@ int ubiblock_create(struct ubi_volume_info *vi)
return 0;
out_remove_minor:
+ list_del(&dev->list);
idr_remove(&ubiblock_minor_idr, gd->first_minor);
out_cleanup_disk:
put_disk(dev->gd);
--
2.38.1
______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH linux-next] ubi: block: Fix a possible use-after-free bug in ubiblock_create()
@ 2023-02-14 9:38 ` Harshit Mogalapalli
0 siblings, 0 replies; 6+ messages in thread
From: Harshit Mogalapalli @ 2023-02-14 9:38 UTC (permalink / raw)
Cc: harshit.m.mogalapalli, error27, hch, Harshit Mogalapalli,
Richard Weinberger, Miquel Raynal, Vignesh Raghavendra, linux-mtd,
linux-kernel
Smatch warns:
drivers/mtd/ubi/block.c:438 ubiblock_create()
warn: '&dev->list' not removed from list
'dev' is freed in 'out_free_dev:, but it is still on the list.
To fix this, delete the list item before freeing.
Fixes: 91cc8fbcc8c7 ("ubi: block: set BLK_MQ_F_BLOCKING")
Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
---
Found by static analysis(smatch). Only Compile tested.
---
drivers/mtd/ubi/block.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/mtd/ubi/block.c b/drivers/mtd/ubi/block.c
index f5d036203fe7..763704c8d05c 100644
--- a/drivers/mtd/ubi/block.c
+++ b/drivers/mtd/ubi/block.c
@@ -429,6 +429,7 @@ int ubiblock_create(struct ubi_volume_info *vi)
return 0;
out_remove_minor:
+ list_del(&dev->list);
idr_remove(&ubiblock_minor_idr, gd->first_minor);
out_cleanup_disk:
put_disk(dev->gd);
--
2.38.1
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH linux-next] ubi: block: Fix a possible use-after-free bug in ubiblock_create()
2023-02-14 9:38 ` Harshit Mogalapalli
@ 2023-02-14 9:47 ` Richard Weinberger
-1 siblings, 0 replies; 6+ messages in thread
From: Richard Weinberger @ 2023-02-14 9:47 UTC (permalink / raw)
To: harshit m mogalapalli
Cc: harshit m mogalapalli, error27, hch, Miquel Raynal,
Vignesh Raghavendra, linux-mtd, linux-kernel
----- Ursprüngliche Mail -----
> Von: "harshit m mogalapalli" <harshit.m.mogalapalli@oracle.com>
> Smatch warns:
> drivers/mtd/ubi/block.c:438 ubiblock_create()
> warn: '&dev->list' not removed from list
>
> 'dev' is freed in 'out_free_dev:, but it is still on the list.
>
> To fix this, delete the list item before freeing.
>
> Fixes: 91cc8fbcc8c7 ("ubi: block: set BLK_MQ_F_BLOCKING")
> Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
> ---
> Found by static analysis(smatch). Only Compile tested.
> ---
> drivers/mtd/ubi/block.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/drivers/mtd/ubi/block.c b/drivers/mtd/ubi/block.c
> index f5d036203fe7..763704c8d05c 100644
> --- a/drivers/mtd/ubi/block.c
> +++ b/drivers/mtd/ubi/block.c
> @@ -429,6 +429,7 @@ int ubiblock_create(struct ubi_volume_info *vi)
> return 0;
>
> out_remove_minor:
> + list_del(&dev->list);
> idr_remove(&ubiblock_minor_idr, gd->first_minor);
> out_cleanup_disk:
> put_disk(dev->gd);
Good catch!
Thanks,
//richard
______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH linux-next] ubi: block: Fix a possible use-after-free bug in ubiblock_create()
@ 2023-02-14 9:47 ` Richard Weinberger
0 siblings, 0 replies; 6+ messages in thread
From: Richard Weinberger @ 2023-02-14 9:47 UTC (permalink / raw)
To: harshit m mogalapalli
Cc: harshit m mogalapalli, error27, hch, Miquel Raynal,
Vignesh Raghavendra, linux-mtd, linux-kernel
----- Ursprüngliche Mail -----
> Von: "harshit m mogalapalli" <harshit.m.mogalapalli@oracle.com>
> Smatch warns:
> drivers/mtd/ubi/block.c:438 ubiblock_create()
> warn: '&dev->list' not removed from list
>
> 'dev' is freed in 'out_free_dev:, but it is still on the list.
>
> To fix this, delete the list item before freeing.
>
> Fixes: 91cc8fbcc8c7 ("ubi: block: set BLK_MQ_F_BLOCKING")
> Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
> ---
> Found by static analysis(smatch). Only Compile tested.
> ---
> drivers/mtd/ubi/block.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/drivers/mtd/ubi/block.c b/drivers/mtd/ubi/block.c
> index f5d036203fe7..763704c8d05c 100644
> --- a/drivers/mtd/ubi/block.c
> +++ b/drivers/mtd/ubi/block.c
> @@ -429,6 +429,7 @@ int ubiblock_create(struct ubi_volume_info *vi)
> return 0;
>
> out_remove_minor:
> + list_del(&dev->list);
> idr_remove(&ubiblock_minor_idr, gd->first_minor);
> out_cleanup_disk:
> put_disk(dev->gd);
Good catch!
Thanks,
//richard
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH linux-next] ubi: block: Fix a possible use-after-free bug in ubiblock_create()
2023-02-14 9:38 ` Harshit Mogalapalli
@ 2023-02-14 14:10 ` Christoph Hellwig
-1 siblings, 0 replies; 6+ messages in thread
From: Christoph Hellwig @ 2023-02-14 14:10 UTC (permalink / raw)
To: Harshit Mogalapalli
Cc: harshit.m.mogalapalli, error27, hch, Richard Weinberger,
Miquel Raynal, Vignesh Raghavendra, linux-mtd, linux-kernel
On Tue, Feb 14, 2023 at 01:38:01AM -0800, Harshit Mogalapalli wrote:
> Smatch warns:
> drivers/mtd/ubi/block.c:438 ubiblock_create()
> warn: '&dev->list' not removed from list
>
> 'dev' is freed in 'out_free_dev:, but it is still on the list.
>
> To fix this, delete the list item before freeing.
>
> Fixes: 91cc8fbcc8c7 ("ubi: block: set BLK_MQ_F_BLOCKING")
> Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Thanks, this looks good:
Reviewed-by: Christoph Hellwig <hch@lst.de>
______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH linux-next] ubi: block: Fix a possible use-after-free bug in ubiblock_create()
@ 2023-02-14 14:10 ` Christoph Hellwig
0 siblings, 0 replies; 6+ messages in thread
From: Christoph Hellwig @ 2023-02-14 14:10 UTC (permalink / raw)
To: Harshit Mogalapalli
Cc: harshit.m.mogalapalli, error27, hch, Richard Weinberger,
Miquel Raynal, Vignesh Raghavendra, linux-mtd, linux-kernel
On Tue, Feb 14, 2023 at 01:38:01AM -0800, Harshit Mogalapalli wrote:
> Smatch warns:
> drivers/mtd/ubi/block.c:438 ubiblock_create()
> warn: '&dev->list' not removed from list
>
> 'dev' is freed in 'out_free_dev:, but it is still on the list.
>
> To fix this, delete the list item before freeing.
>
> Fixes: 91cc8fbcc8c7 ("ubi: block: set BLK_MQ_F_BLOCKING")
> Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Thanks, this looks good:
Reviewed-by: Christoph Hellwig <hch@lst.de>
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2023-02-14 14:54 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2023-02-14 9:38 [PATCH linux-next] ubi: block: Fix a possible use-after-free bug in ubiblock_create() Harshit Mogalapalli
2023-02-14 9:38 ` Harshit Mogalapalli
2023-02-14 9:47 ` Richard Weinberger
2023-02-14 9:47 ` Richard Weinberger
2023-02-14 14:10 ` Christoph Hellwig
2023-02-14 14:10 ` Christoph Hellwig
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.