github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-27 09:36:22 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

mtd: virt_concat: fix use-after-free in mtd_virt_concat_destroy()

Browse Source 
mtd_concat_destroy() frees item->concat so calling
mtd_virt_concat_put_mtd_devices(item->concat) after that leads to a
use-after-free.

Fix it by moving mtd_virt_concat_put_mtd_devices() before
mtd_concat_destroy().

Fixes: 43db6366fc ("mtd: Add driver for concatenating devices")
Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
This commit is contained in:
Harshit Mogalapalli 2026-06-16 03:14:39 -07:00 committed by Miquel Raynal
parent 1a8b2951ba
commit 4b45d7836b
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/mtd/mtd_virt_concat.c
View File

@ -126,8 +126,8 @@ int mtd_virt_concat_destroy(struct mtd_info *mtd)
if (concat->mtd.name) {
del_mtd_device(&concat->mtd);
kfree(concat->mtd.name);
mtd_concat_destroy(&concat->mtd);
mtd_virt_concat_put_mtd_devices(item->concat);
mtd_concat_destroy(&concat->mtd);
}
for (idx = 0; idx < item->count; idx++)