github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

mtd: virt-concat: unlink discarded items before freeing

Browse Source 
mtd_virt_concat_destroy_items() frees each item without removing it
from concat_node_list. list_for_each_entry_safe() protects the
current traversal, but concat_node_list still points to the freed
items afterward.

The function also unwinds errors from mtd_virt_concat_node_create().

A later initialization can traverse a freed item in
mtd_is_part_concat(), causing a use-after-free.

Unlink each item before freeing it.

Fixes: 43db6366fc ("mtd: Add driver for concatenating devices")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.6, smatch
Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
This commit is contained in:
Harshit Mogalapalli 2026-09-25 05:55:45 -07:00 committed by Miquel Raynal
parent 532caaa2f4
commit 112a666bd8
1 changed files with 1 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
drivers/mtd/mtd_virt_concat.c
View File

@ -202,6 +202,7 @@ void mtd_virt_concat_destroy_items(void)
int i;
list_for_each_entry_safe(item, temp, &concat_node_list, head) {
list_del(&item->head);
for (i = 0; i < item->count; i++)
of_node_put(item->nodes[i]);