Messages in this thread | | | Date | Thu, 27 Jul 2023 18:12:04 +0300 | From | Andy Shevchenko <> | Subject | Re: [PATCH] mtd: fix use-after-free in mtd release |
| |
On Thu, Jul 27, 2023 at 05:57:58PM +0300, Alexander Usyskin wrote: > I case of partition device_unregister in mtd_device_release
In
device_unregister() mtd_device_release()
> calls mtd_release which frees mtd_info structure for partition.
mtd_release()
> All code after device_unregister in mtd_device_release thus
device_unregister() mtd_device_release()
> works already freed memory.
uses?
> Move part of code to mtd_release and restict mtd->dev cleanup
mtd_release()
> to non-partion object. > For partition object such cleanup have no sense as partition > mtd_info is removed. > > Cc: Miquel Raynal <miquel.raynal@bootlin.com> > Cc: Zhang Xiaoxu <zhangxiaoxu5@huawei.com> > Fixes: 19bfa9ebebb5 ("mtd: use refcount to prevent corruption")
Closes: ?
-- With Best Regards, Andy Shevchenko
| |