Re: [PATCH v2] mtd: fix use-after-free in mtd release

[Miquel Raynal]

On Mon, 2023-07-31 at 11:58:36 UTC, Alexander Usyskin wrote:
> I case of partition device_unregister() in mtd_device_release()
> calls mtd_release() which frees mtd_info structure for partition.
> All code after device_unregister in mtd_device_release thus
> uses already freed memory.
> 
> Move part of code to mtd_release() and restict mtd->dev cleanup
> to non-partion object.
> For partition object such cleanup have no sense as partition
> mtd_info is removed.
> 
> Cc: Miquel Raynal <miquel.raynal@xxxxxxxxxxx>
> Cc: Zhang Xiaoxu <zhangxiaoxu5@xxxxxxxxxx>
> Fixes: 19bfa9ebebb5 ("mtd: use refcount to prevent corruption")
> Reviewed-by: Tomas Winkler <tomas.winkler@xxxxxxxxx>
> Signed-off-by: Alexander Usyskin <alexander.usyskin@xxxxxxxxx>

Applied to https://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux.git mtd/next, thanks.

Miquel