Messages in this thread | | | From | Miquel Raynal <> | Subject | Re: [PATCH v2] mtd: fix use-after-free in mtd release | Date | Fri, 4 Aug 2023 09:03:35 +0200 |
| |
On Mon, 2023-07-31 at 11:58:36 UTC, Alexander Usyskin wrote: > I case of partition device_unregister() in mtd_device_release() > calls mtd_release() which frees mtd_info structure for partition. > All code after device_unregister in mtd_device_release thus > uses already freed memory. > > Move part of code to mtd_release() and restict mtd->dev cleanup > to non-partion object. > For partition object such cleanup have no sense as partition > mtd_info is removed. > > Cc: Miquel Raynal <miquel.raynal@bootlin.com> > Cc: Zhang Xiaoxu <zhangxiaoxu5@huawei.com> > Fixes: 19bfa9ebebb5 ("mtd: use refcount to prevent corruption") > Reviewed-by: Tomas Winkler <tomas.winkler@intel.com> > Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Applied to https://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux.git mtd/next, thanks.
Miquel
| |