[PATCH] mtd: ubi: Fix UBI device reference leak in ubi_detach_mtd_dev()

[Zhihao Cheng]

在 2026/9/17 18:31, Wentao Liang 写道:
> ubi_detach_mtd_dev() takes a reference on the UBI device with
> ubi_get_device() and drops the matching kobject reference only after
> the shutdown notification has been sent.  When the device is still in
> use and a forced detach was not requested, the function returns -EBUSY
> before that put_device(), so the reference taken by ubi_get_device() is
> never released and the device is never freed.
> 
> Drop the reference on the busy path as well.
> 
> Fixes: 7e84c961b2eb ("mtd: ubi: introduce pre-removal notification for UBI volumes")
> Cc: stable at vger.kernel.org
> Signed-off-by: Wentao Liang <vulab at iscas.ac.cn>
> ---
>   drivers/mtd/ubi/build.c | 1 +
>   1 file changed, 1 insertion(+)

Hi, Wentao, it has been fixed by [1].

[1] 
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/drivers/mtd/ubi/build.c?id=31dd710cd84d5dd63c49f640d3a9f36c9699ca95
> 
> diff --git a/drivers/mtd/ubi/build.c b/drivers/mtd/ubi/build.c
> index 674ad87809df..d81f5e0395ac 100644
> --- a/drivers/mtd/ubi/build.c
> +++ b/drivers/mtd/ubi/build.c
> @@ -1106,6 +1106,7 @@ int ubi_detach_mtd_dev(int ubi_num, int anyway)
>   	if (ubi->ref_count) {
>   		if (!anyway) {
>   			spin_unlock(&ubi_devices_lock);
> +			put_device(&ubi->dev);
>   			return -EBUSY;
>   		}
>   		/* This may only happen if there is a bug */
>