devfs_remove_aliases() frees each struct cdev_alias without unlinking it from cdev->aliases first, so on return the list head still points to freed memory. Nothing trips over this today: the cdevs that get their aliases removed are either freed right afterwards by cdev_free(), or the list is re-initialized by devfs_create() when the cdev is registered again. It is a trap waiting for the next caller though, so unlink the entries properly.
Signed-off-by: Sascha Hauer <[email protected]> Assisted-by: Claude:claude-opus-5 --- fs/devfs-core.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/devfs-core.c b/fs/devfs-core.c index 522d883e1c..b9e34f83bb 100644 --- a/fs/devfs-core.c +++ b/fs/devfs-core.c @@ -583,6 +583,7 @@ static void devfs_remove_aliases(struct cdev *cdev) list_for_each_entry_safe(alias, tmp, &cdev->aliases, list) { devfs_unlink(alias->name); + list_del(&alias->list); free(alias->name); free(alias); } -- 2.47.3
