Re: [PATCH] mtd: fix use-after-free in mtd release

[Andy Shevchenko]

On Thu, Jul 27, 2023 at 05:57:58PM +0300, Alexander Usyskin wrote:
> I case of partition device_unregister in mtd_device_release

In

device_unregister()
mtd_device_release()

> calls mtd_release which frees mtd_info structure for partition.

mtd_release()

> All code after device_unregister in mtd_device_release thus

device_unregister()
mtd_device_release()

> works already freed memory.

uses?

> Move part of code to mtd_release and restict mtd->dev cleanup

mtd_release()

> to non-partion object.
> For partition object such cleanup have no sense as partition
> mtd_info is removed.
> 
> Cc: Miquel Raynal <miquel.raynal@xxxxxxxxxxx>
> Cc: Zhang Xiaoxu <zhangxiaoxu5@xxxxxxxxxx>
> Fixes: 19bfa9ebebb5 ("mtd: use refcount to prevent corruption")

Closes: ?

-- 
With Best Regards,
Andy Shevchenko