CVE-2023-53800

In the Linux kernel, the following vulnerability has been resolved:

ubi: Fix use-after-free when volume resizing failed

There is an use-after-free problem reported by KASAN: ================================================================== BUG: KASAN: use-after-free in ubiebacopy_table+0x11f/0x1c0 [ubi] Read of size 8 at addr ffff888101eec008 by task ubirsvol/4735

CPU: 2 PID: 4735 Comm: ubirsvol Not tainted 6.1.0-rc1-00003-g84fa3304a7fc-dirty #14 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 04/01/2014 Call Trace: <TASK> dumpstacklvl+0x34/0x44 printreport+0x171/0x472 kasanreport+0xad/0x130 ubiebacopytable+0x11f/0x1c0 [ubi] ubiresizevolume+0x4f9/0xbc0 [ubi] ubicdev_ioctl+0x701/0x1850 [ubi] __x64sysioctl+0x11d/0x170 dosyscall64+0x35/0x80 entrySYSCALL64afterhwframe+0x46/0xb0 </TASK>

When ubichangevtblrecord() returns an error in ubiresizevolume(), "newebatbl" will be freed on error handing path, but it is holded by "vol->ebatbl" in ubiebareplacetable(). It means that the liftcycle of "vol->ebatbl" and "vol" are different, so when resizing volume in next time, it causing an use-after-free fault.

Fix it by not freeing "newebatbl" after it replaced in ubiebareplace_table(), while will be freed in next volume resizing.