| Message ID | 20210807214538.14484-5-sean@mess.org |
|---|---|
| State | Accepted |
| Headers | show |
| Series | Fix various issues with RFD and FTLs | expand |
On Sat, 2021-08-07 at 21:45:37 UTC, Sean Young wrote: > del_mtd_blktrans_dev() will kfree part, so after this call both part and > dev point to freed memory. Move the call to avoid use-after-free. > > Signed-off-by: Sean Young <sean@mess.org> Applied to https://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux.git mtd/next, thanks. Miquel
diff --git a/drivers/mtd/rfd_ftl.c b/drivers/mtd/rfd_ftl.c index 7f5f6d247cae..52be9f1fa9a2 100644 --- a/drivers/mtd/rfd_ftl.c +++ b/drivers/mtd/rfd_ftl.c @@ -800,10 +800,10 @@ static void rfd_ftl_remove_dev(struct mtd_blktrans_dev *dev) part->mbd.mtd->name, i, part->blocks[i].erases); } - del_mtd_blktrans_dev(dev); vfree(part->sector_map); kfree(part->header_cache); kfree(part->blocks); + del_mtd_blktrans_dev(dev); } static struct mtd_blktrans_ops rfd_ftl_tr = {
del_mtd_blktrans_dev() will kfree part, so after this call both part and dev point to freed memory. Move the call to avoid use-after-free. Signed-off-by: Sean Young <sean@mess.org> --- drivers/mtd/rfd_ftl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)