linux-kernel - Re: [PATCH] mtd: fix error handling in uif

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <2025031334-paving-jolliness-3383@gregkh>
Date: Thu, 13 Mar 2025 10:47:22 +0100
From: Greg KH <gregkh@...uxfoundation.org>
To: Ma Ke <make24@...as.ac.cn>
Cc: richard@....at, chengzhihao1@...wei.com, miquel.raynal@...tlin.com,
	vigneshr@...com, logang@...tatee.com, linux-mtd@...ts.infradead.org,
	linux-kernel@...r.kernel.org, akpm@...ux-foundation.org,
	stable@...r.kernel.org
Subject: Re: [PATCH] mtd: fix error handling in uif_init()

On Thu, Mar 13, 2025 at 05:16:09PM +0800, Ma Ke wrote:
> Once cdev_device_add() failed, we should call put_device() to decrement
> reference count for cleanup. Or it could cause memory leak.
> 
> Found by code review.
> 
> Cc: stable@...r.kernel.org
> Fixes: 493cfaeaa0c9 ("mtd: utilize new cdev_device_add helper function")
> Signed-off-by: Ma Ke <make24@...as.ac.cn>
> ---
>  drivers/mtd/ubi/build.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/mtd/ubi/build.c b/drivers/mtd/ubi/build.c
> index ef6a22f372f9..ca4c54cf9fd4 100644
> --- a/drivers/mtd/ubi/build.c
> +++ b/drivers/mtd/ubi/build.c
> @@ -486,6 +486,7 @@ static int uif_init(struct ubi_device *ubi)
>  	kill_volumes(ubi);
>  	cdev_device_del(&ubi->cdev, &ubi->dev);
>  out_unreg:
> +	put_device(&ubi->dev);

Oh wow.  No, that's not going to work.

This driver is broken in that there are two different reference counted
structures attempting to manage the same chunk of memory.  Things will
break as your patch here shows.

Please fix this all up to work properly instead, don't think that this
change will actually fix anything :(

thanks,

greg k-h