From 112a666bd82e96e4a01e0cd8a0fb9c88dd0bce38 Mon Sep 17 00:00:00 2001 From: Harshit Mogalapalli Date: Fri, 25 Sep 2026 05:55:45 -0700 Subject: [PATCH] mtd: virt-concat: unlink discarded items before freeing mtd_virt_concat_destroy_items() frees each item without removing it from concat_node_list. list_for_each_entry_safe() protects the current traversal, but concat_node_list still points to the freed items afterward. The function also unwinds errors from mtd_virt_concat_node_create(). A later initialization can traverse a freed item in mtd_is_part_concat(), causing a use-after-free. Unlink each item before freeing it. Fixes: 43db6366fc2d ("mtd: Add driver for concatenating devices") Cc: stable@vger.kernel.org Assisted-by: Codex:gpt-5.6, smatch Signed-off-by: Harshit Mogalapalli Signed-off-by: Miquel Raynal --- drivers/mtd/mtd_virt_concat.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/mtd/mtd_virt_concat.c b/drivers/mtd/mtd_virt_concat.c index 4fad0967a96e..637219e20b80 100644 --- a/drivers/mtd/mtd_virt_concat.c +++ b/drivers/mtd/mtd_virt_concat.c @@ -202,6 +202,7 @@ void mtd_virt_concat_destroy_items(void) int i; list_for_each_entry_safe(item, temp, &concat_node_list, head) { + list_del(&item->head); for (i = 0; i < item->count; i++) of_node_put(item->nodes[i]);