Re: [PATCH] mtd: virt-concat: Tear the concat down when its master goes away

[Yuqiang Sun]

On Mon, Nov 02, 2026 at 08:45:12AM +0000, sashiko-bot@xxxxxxxxxx wrote:
> Thank you for your contribution! Sashiko AI review found 3 potential issue(s) to consider:
> - [Critical] mtd: virt-concat: partition order corrupted on rebind after partial teardown
> - [Critical] mtd: virt-concat: use-after-free when master unbinds with concat held open
> - [High] mtd: virt-concat: double free of eraseregions after add_mtd_device() failure

Thanks, all three are right. I reproduced the reordering with a concat
across two flash devices (it comes back as kbb-kba-concat after the
first one is bound again), and the held-open case.

v2 will keep each part in the slot of its DT node, register the device
that mtd_concat_create() returns instead of a copy in the item (which
also removes the double free of the erase regions after a failed
add_mtd_device()), and keep the concat, its name and the parts of the
master that went away until its last user puts it.

One note on the held-open case: a plain partition held open while its
flash driver is unbound also gives use-after-free reports in the MTD
core and the CFI driver, since the driver frees the master while the
open device is still around. So v2 makes a held-open concat no worse
than a partition there, but does not fix that part.

I will send v2 tomorrow, to leave time for comments on v1.