iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

mtd: rfd_ftl: fix use-after-free

Browse Source 
del_mtd_blktrans_dev() will kfree part, so after this call both part and
dev point to freed memory. Move the call to avoid use-after-free.

Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20210807214538.14484-5-sean@mess.org
This commit is contained in:
Sean Young 2021-08-07 22:45:37 +01:00 committed by Miquel Raynal
parent a3a447848a
commit d056f8cd2f
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/mtd/rfd_ftl.c
View File

@ -800,10 +800,10 @@ static void rfd_ftl_remove_dev(struct mtd_blktrans_dev *dev)
part->mbd.mtd->name, i, part->blocks[i].erases);
}
del_mtd_blktrans_dev(dev);
vfree(part->sector_map);
kfree(part->header_cache);
kfree(part->blocks);
del_mtd_blktrans_dev(dev);
}
static struct mtd_blktrans_ops rfd_ftl_tr = {