Re: [PATCH] mtd: virt_concat: fix use-after-free in mtd_virt_concat_destroy()
Miquel Raynal <[email protected]> Mon, 29 Jun 2026 16:44:07 +0200
| Newsgroups | org.kernel.vger.kernel-janitors,org.infradead.lists.linux-mtd,org.kernel.vger.linux-kernel |
|---|---|
| Message-ID | <[email protected]> |
On Tue, 16 Jun 2026 03:14:39 -0700, Harshit Mogalapalli wrote:
> mtd_concat_destroy() frees item->concat so calling
> mtd_virt_concat_put_mtd_devices(item->concat) after that leads to a
> use-after-free.
>
> Fix it by moving mtd_virt_concat_put_mtd_devices() before
> mtd_concat_destroy().
>
> [...]
Applied to mtd/fixes, thanks!
[1/1] mtd: virt_concat: fix use-after-free in mtd_virt_concat_destroy()
commit: 4b45d7836b9526b8776af5f29219615be9417230
Patche(s) should be available on mtd/linux.git and will be
part of the next PR (provided that no robot complains by then).
Kind regards,
Miquèl