Re: [PATCH] mtd: virt_concat: fix use-after-free in mtd_virt_concat_destroy_joins()
Miquel Raynal <[email protected]> Mon, 29 Jun 2026 16:39:38 +0200
| Newsgroups | org.kernel.vger.kernel-janitors,org.infradead.lists.linux-mtd,org.kernel.vger.linux-kernel |
|---|---|
| Message-ID | <[email protected]> |
On Sun, 14 Jun 2026 01:10:52 -0700, Harshit Mogalapalli wrote:
> mtd_concat_destroy() frees item->concat so calling
> mtd_virt_concat_put_mtd_devices(item->concat) leads to a use after free.
>
> Fix this by moving mtd_virt_concat_put_mtd_devices() before
> mtd_concat_destroy()
>
>
> [...]
Applied to mtd/fixes, thanks!
[1/1] mtd: virt_concat: fix use-after-free in mtd_virt_concat_destroy_joins()
commit: 75c0c09541b49daa08fddbc2c18c2232f4eab7d8
Patche(s) should be available on mtd/linux.git and will be
part of the next PR (provided that no robot complains by then).
Kind regards,
Miquèl