From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qk1-f181.google.com (mail-qk1-f181.google.com [209.85.222.181]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id ACCB7175A85 for ; Thu, 16 Apr 2026 01:11:33 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.222.181 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776301895; cv=none; b=QdJvZE3BfKDv26vNwRVU8RVvOUoGnMj0G78qGFj0Vof72eAaPTWL3h9eA1jIrICIgxU09UwsbfZ9dUvcdb/yzk7Ps9oqGGl87+tDfcf9UIUN/QjuUVbW+cpt2Gs/u/+tMilFZT6xXsZuqWOUjqHOOKgccJfPsipRwGB+R4UJrN8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776301895; c=relaxed/simple; bh=vEsN5AB4P4N9sQ748N2vZsJLZzIjZD42dfThXsXV2jI=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=k0Ontkn7u8m0RHV5n/YhjLOf7v82SXmdbNj/b2Vzq9ggPcBANNVkSbwnsLulezDqZvZ2M+pAedPkKqLdTuttSP1JFnhtFAyZB4l/VNiXYZYfCZzY9SD+UzHPZCW74Ub6CK4AQQM8MTian+4w+6puFSTKiRjAa5J0CrZgYo6nuW0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Vqyu3sUk; arc=none smtp.client-ip=209.85.222.181 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Vqyu3sUk" Received: by mail-qk1-f181.google.com with SMTP id af79cd13be357-8c6f21c2d81so562471985a.2 for ; Wed, 15 Apr 2026 18:11:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1776301893; x=1776906693; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=QfpySMydajhmy8CDZ0KzUQHaW9x3r0jflQmjPEkL1UA=; b=Vqyu3sUkNW+6XfPqGCnMGZXBsr5esIS2p3UGMqiAoHCn3m4ZWx7bdULtGYZv4qYnfS qo+ZG1sFDZz9wtHqoAtoweBdNI2kBsPajuo3ZTqR8BlRpQacjIK4/OnfuEllUedGaDKw B2LeBE7YriAdZ8KHqTppkSMQomUxmfCi99AJYzpa2B14+4csm2/EYAO5LnBBWSCTvB8v l34JtgUZUwL2nFyhIXn6YyFqa7eLzVkR4gmcJ2UPI+2PPge2D/mC3yzAZopYAEo0m54H Q/TGyAuKef6qzsQOXIHtjOSeP3d61p0lp6ly6PmlOcLPbAH2KDLcTAgiSXpOUpOYi80c 42vg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1776301893; x=1776906693; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=QfpySMydajhmy8CDZ0KzUQHaW9x3r0jflQmjPEkL1UA=; b=EvVQ5Ga03vdqyoh1nuY9LZS4isbiysR6crTlvqjh5FNHGQIv5jtT1jF01iViHC9iTX 26o2DtL0m0RrKCMvaCeTfArYey6EGyrWQVLbf3usBgQb60fcIcBduM1Prz6ah5PCiUOc WKVNYj7GkOIEgEWg/cbXttcVsnTGz9ZnY3TsV6KjPofsuBAWLDAGRJm3o/GI7HZC0buM +BnODafO60tz37UD4vrK2+nWSWczU2cfJw8LVeZU6lDuNbDCEhiHQ3vjQl56pU67OHev v5NrYJ29oXiqROKRCFrSXf4uopscis4L9H4Xfz0qZYJISFqz4+EowqAXI2yGMrgYYG85 8i7w== X-Forwarded-Encrypted: i=1; AFNElJ+bplQbzU5L6wuUSrvsZdmsAwiK8IRzh583ZFn1N2qQhItGA4NGrEnnbBD9jJIi4uBgb9zU8/Uwvk2jVg8=@vger.kernel.org X-Gm-Message-State: AOJu0Ywn0MpknbL3emijAF2hjl2KDFMpvhob7slCT74mB7ORMbOqCf5H hGwgMBUbwZ8PF6+KX6wwQ/dvjyboTtiiu8JA9n0KpSP5iQpdotF8LVBD X-Gm-Gg: AeBDietRV4vjwurZ51Xw9MVKEB/vfv59zsR24FfiwXdPnTfgbz/U/muI6PPda0M63B7 gfrTOvB/yhX6sGn4hwgvC7TMj7c3z8P5kEaip5OVPt8hFjPrzLRRuNiy60gPg2nWVx5wrzP5b9V V7lsrIG2vqOgR8F8r14BtQlho6x/iEY0nnr2awkTB83wzLu4WLF42ShNVgaZZg7jFoqSxR836eB 4wmmltGIOlkFjC8kQeS4+Go0sxMR/XB+pE78AnMyFilPQmU3gZVWXAB+J0jSkVVVZlKLzP3IW/A KI1QWiE9JXeM96+U7n904+BLPYipsZFVnJJiGsFiJXoeHpWP6wdcKT7/fzxsJ+VenvB+CJ+yEGO 765ilIzdcsYc1HqETS6TC95KSFipayx1VRcS3GWajdUotoONai9Fxg6mPvemg/882VF/jhxAZPn rAMmSyWhgFxRE0vD+hCY7Yq9iPHrTbWiAWOGkc3cQYpNqu2T/0BNmyLIU+0Q== X-Received: by 2002:a05:620a:d86:b0:8cf:cfdf:7346 with SMTP id af79cd13be357-8ddcecbd993mr3555177485a.30.1776301892568; Wed, 15 Apr 2026 18:11:32 -0700 (PDT) Received: from localhost.localdomain ([165.85.38.17]) by smtp.gmail.com with ESMTPSA id af79cd13be357-8e4f29227a5sm244769885a.32.2026.04.15.18.11.31 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Wed, 15 Apr 2026 18:11:32 -0700 (PDT) From: Yuho Choi To: Richard Weinberger , Miquel Raynal , Vignesh Raghavendra Cc: Zhihao Cheng , linux-mtd@lists.infradead.org, linux-kernel@vger.kernel.org, Yuho Choi Subject: [PATCH v1] mtd: ubi: fix kref leak on -EBUSY return in ubi_detach_mtd_dev() Date: Wed, 15 Apr 2026 21:11:28 -0400 Message-ID: <20260416011128.45754-1-dbgh9129@gmail.com> X-Mailer: git-send-email 2.50.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit ubi_detach_mtd_dev() calls ubi_get_device() which increments both ubi->ref_count and the device kref via get_device(). When the device is busy and anyway==0, the function returns -EBUSY after releasing ubi_devices_lock, but never calls put_device() to drop the kref acquired by ubi_get_device(). This leaks the kref, preventing the device from ever being freed. Commit 7e84c961b2eb ("mtd: ubi: introduce pre-removal notification for UBI volumes") moved put_device() to after ubi->is_dead = true to pair it with the notify+nullify sequence, but inadvertently left the early -EBUSY return without a matching put_device(). Add put_device(&ubi->dev) before returning -EBUSY to balance the get_device() inside ubi_get_device(). Fixes: 7e84c961b2eb ("mtd: ubi: introduce pre-removal notification for UBI volumes") Signed-off-by: Yuho Choi --- drivers/mtd/ubi/build.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/mtd/ubi/build.c b/drivers/mtd/ubi/build.c index 674ad87809df0..d81f5e0395ac0 100644 --- a/drivers/mtd/ubi/build.c +++ b/drivers/mtd/ubi/build.c @@ -1106,6 +1106,7 @@ int ubi_detach_mtd_dev(int ubi_num, int anyway) if (ubi->ref_count) { if (!anyway) { spin_unlock(&ubi_devices_lock); + put_device(&ubi->dev); return -EBUSY; } /* This may only happen if there is a bug */ -- 2.50.1 (Apple Git-155)