[PATCH 1/4] fs: devfs: remove aliases from the list when freeing them

[Sascha Hauer]

devfs_remove_aliases() frees each struct cdev_alias without unlinking it
from cdev->aliases first, so on return the list head still points to
freed memory. Nothing trips over this today: the cdevs that get their
aliases removed are either freed right afterwards by cdev_free(), or the
list is re-initialized by devfs_create() when the cdev is registered
again. It is a trap waiting for the next caller though, so unlink the
entries properly.

Signed-off-by: Sascha Hauer <s.hauer at pengutronix.de>
Assisted-by: Claude:claude-opus-5
---
 fs/devfs-core.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/devfs-core.c b/fs/devfs-core.c
index 522d883e1c..b9e34f83bb 100644
--- a/fs/devfs-core.c
+++ b/fs/devfs-core.c
@@ -583,6 +583,7 @@ static void devfs_remove_aliases(struct cdev *cdev)
 
 	list_for_each_entry_safe(alias, tmp, &cdev->aliases, list) {
 		devfs_unlink(alias->name);
+		list_del(&alias->list);
 		free(alias->name);
 		free(alias);
 	}

-- 
2.47.3