diff options
| author | Sean Young <sean@mess.org> | 2021-08-08 00:45:37 +0300 |
|---|---|---|
| committer | Miquel Raynal <miquel.raynal@bootlin.com> | 2021-08-17 19:42:58 +0300 |
| commit | d056f8cd2fc29fbfb45f936cc1ac36ff67d7db93 (patch) | |
| tree | f36feb789a6a143782a2fb97c9cedf26c8561776 | |
| parent | a3a447848a153d0dae63d02ceb94b02fb43ec899 (diff) | |
| download | linux-d056f8cd2fc29fbfb45f936cc1ac36ff67d7db93.tar.xz | |
mtd: rfd_ftl: fix use-after-free
del_mtd_blktrans_dev() will kfree part, so after this call both part and
dev point to freed memory. Move the call to avoid use-after-free.
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20210807214538.14484-5-sean@mess.org
| -rw-r--r-- | drivers/mtd/rfd_ftl.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/mtd/rfd_ftl.c b/drivers/mtd/rfd_ftl.c index 7f5f6d247cae..52be9f1fa9a2 100644 --- a/drivers/mtd/rfd_ftl.c +++ b/drivers/mtd/rfd_ftl.c @@ -800,10 +800,10 @@ static void rfd_ftl_remove_dev(struct mtd_blktrans_dev *dev) part->mbd.mtd->name, i, part->blocks[i].erases); } - del_mtd_blktrans_dev(dev); vfree(part->sector_map); kfree(part->header_cache); kfree(part->blocks); + del_mtd_blktrans_dev(dev); } static struct mtd_blktrans_ops rfd_ftl_tr = { |