7.3-stable review patch. If anyone has any objections, please let me know. ------------------ From: Harshit Mogalapalli commit 532caaa2f445b22b74b88b4023a810426772db54 upstream. mtd_virt_concat_create_item() links each new mtd_virt_concat_node to concat_node_list. mtd_virt_concat_destroy() later frees the node after destroying its concatenated MTD device, but fails to unlink it. A later list traversal dereferences the freed node, causing a use-after-free. Remove the node from concat_node_list before freeing it. Fixes: 43db6366fc2d ("mtd: Add driver for concatenating devices") Cc: stable@vger.kernel.org Assisted-by: Codex:gpt-5.6, smatch Signed-off-by: Harshit Mogalapalli Signed-off-by: Miquel Raynal Signed-off-by: Greg Kroah-Hartman --- drivers/mtd/mtd_virt_concat.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/mtd/mtd_virt_concat.c b/drivers/mtd/mtd_virt_concat.c index da4277ced4d6..4fad0967a96e 100644 --- a/drivers/mtd/mtd_virt_concat.c +++ b/drivers/mtd/mtd_virt_concat.c @@ -130,6 +130,7 @@ int mtd_virt_concat_destroy(struct mtd_info *mtd) mtd_concat_destroy(&concat->mtd); } + list_del(&item->head); for (idx = 0; idx < item->count; idx++) of_node_put(item->nodes[idx]); -- 2.56.0