mtd: virt-concat: unlink discarded items before freeing

mtd_virt_concat_destroy_items() frees each item without removing it
from concat_node_list. list_for_each_entry_safe() protects the
current traversal, but concat_node_list still points to the freed
items afterward.

The function also unwinds errors from mtd_virt_concat_node_create().

A later initialization can traverse a freed item in
mtd_is_part_concat(), causing a use-after-free.

Unlink each item before freeing it.

Fixes: 43db6366fc2d ("mtd: Add driver for concatenating devices")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.6, smatch
Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>

0 files changed, 0 insertions, 0 deletions