Commit d056f8cd authored by Sean Young's avatar Sean Young Committed by Miquel Raynal
Browse files

mtd: rfd_ftl: fix use-after-free 



del_mtd_blktrans_dev() will kfree part, so after this call both part and
dev point to freed memory. Move the call to avoid use-after-free.

Signed-off-by: default avatarSean Young <sean@mess.org>
Signed-off-by: default avatarMiquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20210807214538.14484-5-sean@mess.org
parent a3a44784

drivers/mtd/rfd_ftl.c

+1 −1
Original line number Diff line number Diff line
@@ -800,10 +800,10 @@ static void rfd_ftl_remove_dev(struct mtd_blktrans_dev *dev) 
			part->mbd.mtd->name, i, part->blocks[i].erases);

	}



	del_mtd_blktrans_dev(dev);

	vfree(part->sector_map);

	kfree(part->header_cache);

	kfree(part->blocks);

	del_mtd_blktrans_dev(dev);

}



static struct mtd_blktrans_ops rfd_ftl_tr = {