From d056f8cd2fc29fbfb45f936cc1ac36ff67d7db93 Mon Sep 17 00:00:00 2001 From: Sean Young Date: Sat, 7 Aug 2021 22:45:37 +0100 Subject: mtd: rfd_ftl: fix use-after-free del_mtd_blktrans_dev() will kfree part, so after this call both part and dev point to freed memory. Move the call to avoid use-after-free. Signed-off-by: Sean Young Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/20210807214538.14484-5-sean@mess.org --- drivers/mtd/rfd_ftl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/mtd/rfd_ftl.c b/drivers/mtd/rfd_ftl.c index 7f5f6d247cae..52be9f1fa9a2 100644 --- a/drivers/mtd/rfd_ftl.c +++ b/drivers/mtd/rfd_ftl.c @@ -800,10 +800,10 @@ static void rfd_ftl_remove_dev(struct mtd_blktrans_dev *dev) part->mbd.mtd->name, i, part->blocks[i].erases); } - del_mtd_blktrans_dev(dev); vfree(part->sector_map); kfree(part->header_cache); kfree(part->blocks); + del_mtd_blktrans_dev(dev); } static struct mtd_blktrans_ops rfd_ftl_tr = { -- cgit v1.2.3