Re: [PATCH] mtd: virt_concat: fix use-after-free in mtd_virt_concat_destroy_joins()
From: Miquel Raynal
Date: Mon Jun 29 2026 - 10:53:50 EST
On Sun, 14 Jun 2026 01:10:52 -0700, Harshit Mogalapalli wrote:
> mtd_concat_destroy() frees item->concat so calling
> mtd_virt_concat_put_mtd_devices(item->concat) leads to a use after free.
>
> Fix this by moving mtd_virt_concat_put_mtd_devices() before
> mtd_concat_destroy()
>
>
> [...]
Applied to mtd/fixes, thanks!
[1/1] mtd: virt_concat: fix use-after-free in mtd_virt_concat_destroy_joins()
commit: 75c0c09541b49daa08fddbc2c18c2232f4eab7d8
Patche(s) should be available on mtd/linux.git and will be
part of the next PR (provided that no robot complains by then).
Kind regards,
Miquèl