[bug report] mtd: rawnand: ndfc: Stop using nand_release()

[bug report] mtd: rawnand: ndfc: Stop using nand_release()

[Dan Carpenter]

Hello Miquel Raynal,

Commit a9384f95fe77 ("mtd: rawnand: ndfc: Stop using nand_release()")
from May 19, 2020 (linux-next), leads to the following Smatch static
checker warning:

	drivers/mtd/nand/raw/ndfc.c:254 ndfc_remove()
	error: dereferencing freed memory 'mtd' (line 251)

drivers/mtd/nand/raw/ndfc.c
    244 static void ndfc_remove(struct platform_device *ofdev)
    245 {
    246         struct ndfc_controller *ndfc = dev_get_drvdata(&ofdev->dev);
    247         struct nand_chip *chip = &ndfc->chip;
    248         struct mtd_info *mtd = nand_to_mtd(chip);
    249         int ret;
    250 
    251         ret = mtd_device_unregister(mtd);
    252         WARN_ON(ret);

This WARN_ON() would trigger if the use after free were a real issue...

Smatch is complaining that the mtd_virt_concat_destroy() function frees
mtd->name and mtd.

    253         nand_cleanup(chip);
--> 254         kfree(mtd->name);
                      ^^^^^^^^^
So this is a use after free double free.

I feel like the free in mtd_virt_concat_destroy() is done at the wrong
layer and should just be removed.  But I haven't looked at it very
closely.

    255 }

This email is a free service from the Smatch-CI project [smatch.sf.net].

regards,
dan carpenter

______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/