[PATCH] mtd: ubi: Fix UBI device reference leak in ubi_detach_mtd_dev()

[PATCH] mtd: ubi: Fix UBI device reference leak in ubi_detach_mtd_dev()

[Wentao Liang]

ubi_detach_mtd_dev() takes a reference on the UBI device with
ubi_get_device() and drops the matching kobject reference only after
the shutdown notification has been sent.  When the device is still in
use and a forced detach was not requested, the function returns -EBUSY
before that put_device(), so the reference taken by ubi_get_device() is
never released and the device is never freed.

Drop the reference on the busy path as well.

Fixes: 7e84c961b2eb ("mtd: ubi: introduce pre-removal notification for UBI volumes")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/mtd/ubi/build.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/mtd/ubi/build.c b/drivers/mtd/ubi/build.c
index 674ad87809df..d81f5e0395ac 100644
--- a/drivers/mtd/ubi/build.c
+++ b/drivers/mtd/ubi/build.c
@@ -1106,6 +1106,7 @@ int ubi_detach_mtd_dev(int ubi_num, int anyway)
 	if (ubi->ref_count) {
 		if (!anyway) {
 			spin_unlock(&ubi_devices_lock);
+			put_device(&ubi->dev);
 			return -EBUSY;
 		}
 		/* This may only happen if there is a bug */
-- 
2.34.1

Re: [PATCH] mtd: ubi: Fix UBI device reference leak in ubi_detach_mtd_dev()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] mtd: ubi: double put of ubi_device in ubi_detach_mtd_dev()
--

commit dc1e1560c6a92e217dc3827eb13a6c41acadcafb
Author: Wentao Liang <vulab@iscas.ac.cn>

mtd: ubi: Fix UBI device reference leak in ubi_detach_mtd_dev()

ubi_detach_mtd_dev() takes a reference on the UBI device with ubi_get_device()
and attempts to drop it. This patch aims to fix a reference leak when returning
-EBUSY.

> diff --git a/drivers/mtd/ubi/build.c b/drivers/mtd/ubi/build.c
> index a901f8edfa41d..866638c006494 100644
> --- a/drivers/mtd/ubi/build.c
> +++ b/drivers/mtd/ubi/build.c
> @@ -1073,6 +1073,7 @@ int ubi_detach_mtd_dev(int ubi_num, int anyway)
>  	if (ubi->ref_count) {
>  		if (!anyway) {
>  			spin_unlock(&ubi_devices_lock);
> +			put_device(&ubi->dev);

[Severity: High]
Does this code double-put the ubi_device on the error path?

Looking at ubi_detach_mtd_dev() in drivers/mtd/ubi/build.c, put_device() is
already called right before the ref_count check:

	spin_lock(&ubi_devices_lock);
	put_device(&ubi->dev);
	ubi->ref_count -= 1;
	if (ubi->ref_count) {
		if (!anyway) {
			spin_unlock(&ubi_devices_lock);

Adding another put_device(&ubi->dev) here drops a kobject reference that the
function does not own, leading to premature freeing of struct ubi_device memory
via dev_release while it is still in use by other kernel components.

If a user with CAP_SYS_RESOURCE calls the UBI_IOCDET ioctl on the UBI control
device while the target UBI device is in use, ubi->ref_count is > 0, leading
ubi_detach_mtd_dev() to return -EBUSY and execute this path.

This appears to be a flawed backport intended for a newer kernel tree where
put_device() was actually missing from this block (due to commit 7e84c961b2eb).
In this baseline, the reference is already correctly dropped before the -EBUSY
check.

>  			return -EBUSY;
>  		}
>  		/* This may only happen if there is a bug */

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260917103102.2147038-1-vulab@iscas.ac.cn?part=1

Re: [PATCH] mtd: ubi: Fix UBI device reference leak in ubi_detach_mtd_dev()

[Zhihao Cheng]

在 2026/9/17 18:31, Wentao Liang 写道:
> ubi_detach_mtd_dev() takes a reference on the UBI device with
> ubi_get_device() and drops the matching kobject reference only after
> the shutdown notification has been sent.  When the device is still in
> use and a forced detach was not requested, the function returns -EBUSY
> before that put_device(), so the reference taken by ubi_get_device() is
> never released and the device is never freed.
> 
> Drop the reference on the busy path as well.
> 
> Fixes: 7e84c961b2eb ("mtd: ubi: introduce pre-removal notification for UBI volumes")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>   drivers/mtd/ubi/build.c | 1 +
>   1 file changed, 1 insertion(+)

Hi, Wentao, it has been fixed by [1].

[1] 
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/drivers/mtd/ubi/build.c?id=31dd710cd84d5dd63c49f640d3a9f36c9699ca95
> 
> diff --git a/drivers/mtd/ubi/build.c b/drivers/mtd/ubi/build.c
> index 674ad87809df..d81f5e0395ac 100644
> --- a/drivers/mtd/ubi/build.c
> +++ b/drivers/mtd/ubi/build.c
> @@ -1106,6 +1106,7 @@ int ubi_detach_mtd_dev(int ubi_num, int anyway)
>   	if (ubi->ref_count) {
>   		if (!anyway) {
>   			spin_unlock(&ubi_devices_lock);
> +			put_device(&ubi->dev);
>   			return -EBUSY;
>   		}
>   		/* This may only happen if there is a bug */
>