diff options
| author | Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com> | 2026-09-25 05:55:44 -0700 |
|---|---|---|
| committer | Miquel Raynal <miquel.raynal@bootlin.com> | 2026-09-25 15:42:19 +0200 |
| commit | 532caaa2f445b22b74b88b4023a810426772db54 (patch) | |
| tree | 2a5515295d4350a3d526af1c2f535da974f78882 /scripts/Makefile.thinlto | |
| parent | 2e566a6830b82d95837c4d669c63a0c1abf766a9 (diff) | |
| download | linux-532caaa2f445b22b74b88b4023a810426772db54.tar.gz linux-532caaa2f445b22b74b88b4023a810426772db54.zip | |
mtd: virt-concat: unlink concat node before freeing it
mtd_virt_concat_create_item() links each new mtd_virt_concat_node to
concat_node_list. mtd_virt_concat_destroy() later frees the node after
destroying its concatenated MTD device, but fails to unlink it. A later
list traversal dereferences the freed node, causing a use-after-free.
Remove the node from concat_node_list before freeing it.
Fixes: 43db6366fc2d ("mtd: Add driver for concatenating devices")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.6, smatch
Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Diffstat (limited to 'scripts/Makefile.thinlto')
0 files changed, 0 insertions, 0 deletions