summaryrefslogtreecommitdiff
path: root/drivers/mtd/rfd_ftl.c
diff options
context:
space:
mode:
authorSean Young <sean@mess.org>2021-08-08 00:45:37 +0300
committerMiquel Raynal <miquel.raynal@bootlin.com>2021-08-17 19:42:58 +0300
commitd056f8cd2fc29fbfb45f936cc1ac36ff67d7db93 (patch)
treef36feb789a6a143782a2fb97c9cedf26c8561776 /drivers/mtd/rfd_ftl.c
parenta3a447848a153d0dae63d02ceb94b02fb43ec899 (diff)
downloadlinux-d056f8cd2fc29fbfb45f936cc1ac36ff67d7db93.tar.xz
mtd: rfd_ftl: fix use-after-free
del_mtd_blktrans_dev() will kfree part, so after this call both part and dev point to freed memory. Move the call to avoid use-after-free. Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com> Link: https://lore.kernel.org/linux-mtd/20210807214538.14484-5-sean@mess.org
Diffstat (limited to 'drivers/mtd/rfd_ftl.c')
-rw-r--r--drivers/mtd/rfd_ftl.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/mtd/rfd_ftl.c b/drivers/mtd/rfd_ftl.c
index 7f5f6d247cae..52be9f1fa9a2 100644
--- a/drivers/mtd/rfd_ftl.c
+++ b/drivers/mtd/rfd_ftl.c
@@ -800,10 +800,10 @@ static void rfd_ftl_remove_dev(struct mtd_blktrans_dev *dev)
part->mbd.mtd->name, i, part->blocks[i].erases);
}
- del_mtd_blktrans_dev(dev);
vfree(part->sector_map);
kfree(part->header_cache);
kfree(part->blocks);
+ del_mtd_blktrans_dev(dev);
}
static struct mtd_blktrans_ops rfd_ftl_tr = {