]> exis.tech > repos - linux.git/commit
mtd: virt_concat: fix use-after-free in mtd_virt_concat_destroy_joins()
authorHarshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Sun, 14 Jun 2026 08:10:52 +0000 (01:10 -0700)
committerMiquel Raynal <miquel.raynal@bootlin.com>
Mon, 29 Jun 2026 14:38:55 +0000 (16:38 +0200)
commit75c0c09541b49daa08fddbc2c18c2232f4eab7d8
tree63a888c511b6d3e9263c40fab67e4bec98f965ab
parentcceca8cb776b03e83985578f84bd730c30d57f70
mtd: virt_concat: fix use-after-free in mtd_virt_concat_destroy_joins()

mtd_concat_destroy() frees item->concat so calling
mtd_virt_concat_put_mtd_devices(item->concat) leads to a use after free.

Fix this by moving mtd_virt_concat_put_mtd_devices() before
mtd_concat_destroy()

Fixes: 43db6366fc2d ("mtd: Add driver for concatenating devices")
Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
drivers/mtd/mtd_virt_concat.c