Double-freed in mo_task_cancel()

[vicLin8712]

Issue

Code:

int32_t mo_task_cancel(uint16_t id)
    ....
    list_remove(kcb->tasks, node);

    ...
    free(node);

However, free() has been called in list_remove():

static inline void *list_remove(list_t *list, list_node_t *target)
{
   ...
    prev->next = target->next;
    void *data = target->data;
    free(target);
    list->length--;
    return data;
}