From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qk1-f181.google.com (mail-qk1-f181.google.com [209.85.222.181]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4C39443634F for ; Tue, 16 Jun 2026 10:13:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.222.181 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781604802; cv=none; b=tXEQ2THqWCBQJz+l6u31DgjSN155TPYUDdQOh8CBVwbGdHVkTVG/T49kfonPP6uYGF6/OvBbRDcO/wWRmlov4kMov7W08tin+IfSdvZ3qSI8KwfdC0qjvC1d6ZEQougjUSMWVpM3tseNtLbEowfxr4McDuuUenx839Ft0NXTRhM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781604802; c=relaxed/simple; bh=xfrZmesiSEPynX9YX7U8MOnPvnmdik4XXr5qgkOwJik=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=FruvXW2FfRbMny6pTFdAAF8ptGyfzwLWguPBqT9yzL0FDNWiyEk3GFiOu/6agES3RlYjYXvwK1TKZ25YdgYpiKrFIapBtAaOyqcAOrLupTum26Rzbmj6Kctwf4jDwRcNGVv5HgRGoobuuSsNKVzJunrnyehaaLufl4s0s6DPWcg= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=KLgsjCAM; arc=none smtp.client-ip=209.85.222.181 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="KLgsjCAM" Received: by mail-qk1-f181.google.com with SMTP id af79cd13be357-9157d3f2098so508524285a.3 for ; Tue, 16 Jun 2026 03:13:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1781604800; x=1782209600; darn=vger.kernel.org; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:from:to:cc:subject:date:message-id:reply-to; bh=+M/4BfCg4kebp/5c+3KqKstn3ZcQMD8Dq5coTSVGSOk=; b=KLgsjCAMl/E+ge90HpDPWTRdL6NiLZJPLEzQfmfhtIkntwdp7wIOzz8AxvCcO7nuPo sR73631XjK2B+MwpcCKNi+Acg4lp/JjMFJXvrkh3F8tvusXReG6eUIZbZLEcjp+UfMuJ 3hc+6N0yUnoSf01CRLikIRemZlXkfI7rCJJVwqDTL+HZ49kT/220xHUxYueSS6C1mD76 6+A7cEM5S/XFULzDPcP4e04UHQTfYGDRCz/jjkquJrUQ4GblPvpP2sHEwTRLBRQ10yI/ ejlYsva3MpuiwzO68A4twhs/7CdewbuoV14SIF1jr1dAjucFjqKraZGOQqZ1XEaNot4+ 2HAQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781604800; x=1782209600; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:x-gm-gg:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=+M/4BfCg4kebp/5c+3KqKstn3ZcQMD8Dq5coTSVGSOk=; b=LL2mT+641bMRZe4viO+1/ho0uiL7cegBC4kB8Jr5Nlg0P44AkS6i7u7ECI84AuTEJz nGLtzq0700MKPysStWcfWJyBN957QKlLSP5FA2Sdj9m7sTA1ap7EcDzNJ1BpdhC0dUYx 84Z9g7nDgcCjbMA/GiUOmwsKAUlxBEfL/VMU62kSCCCV7QYY6rTwsMlsNVkDFbijsJAW gOb8CRtPY7rySL7ySK2+HBbjMmsCGIW5KbUKB/HqWGGybvTLHJrni5owbargzllC4Kky UBK2r06bbxzUh5xwTh9nSCj40I6I7KRD3iiPhR6oEbpz3SjNDeBOAe3fCSZLF4R8knfK j3Rg== X-Forwarded-Encrypted: i=1; AFNElJ+sKJ7B1P/kWPcEgY/GhWychsLFCPIOwWvcOjIrhnQm9NXoFpBbrpYGaVKU1Vhw061c+lSZXvdaOTbgMc8=@vger.kernel.org X-Gm-Message-State: AOJu0YzPwWtFMQ0S9ieySa+bys341PuaAGJHOM2mLryfqAhRteUvTbWy IrUaH96EtvQR7t3w4JtSuVZKiJj7dp7926+UiKGTqeDmAl60SSwdZ/fn X-Gm-Gg: Acq92OHy4AkXbNxLFAtbLCsvUHMtT5kOX3itbKn16Cnw3X7h1VVsv1qeRUd2ZpKRJIg tmuzu4RjSSOi1jTa3hd2Xf5d7eM5yut8/sanv5VjwUD99H3fx72x3NyPD0z964lRK5HvcvUivoK hHBu1h3Q7Q7Svi5yv452ZUU1G57TZEWOfLbSTnzaIWJdNM1te3cktTA1mKRHYKZSLG9soVzsfp7 h47z53stpv/lRp0+VupO7hj3S5Y3IQfApcagOy2O6IhJlTPp0VxKkw3/GTAQDqETPRXgEwR8RtI 3BLu9nKjvSdDBSVjAHzoqsZTSf0D/O1cv0HofD/5O1266LPJuEqDLh1AujP9bT36v1vj8dE1ocG aJP3NSvvuGoRiQj4jT0vS4PjV+l7rAYsq2xIWuMM/rkaTsa4sX7lzNAVVHNxFCtpzzeC3nXSf17 bIH/GI9gUVvPmlro0A X-Received: by 2002:a05:620a:628b:b0:915:86c6:8432 with SMTP id af79cd13be357-9161bc4aa09mr2765037285a.14.1781604800130; Tue, 16 Jun 2026 03:13:20 -0700 (PDT) Received: from localhost ([43.225.189.75]) by smtp.gmail.com with ESMTPSA id af79cd13be357-9161a03bd31sm1425927085a.34.2026.06.16.03.13.18 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 16 Jun 2026 03:13:19 -0700 (PDT) Date: Tue, 16 Jun 2026 13:13:13 +0300 From: Dan Carpenter To: Luca Ceresoli Cc: Harshit Mogalapalli , Miquel Raynal , Richard Weinberger , Vignesh Raghavendra , Amit Kumar Mahapatra , linux-mtd@lists.infradead.org, linux-kernel@vger.kernel.org, kernel-janitors@vger.kernel.org Subject: Re: [PATCH] mtd: virt_concat: fix use-after-free in mtd_virt_concat_destroy_joins() Message-ID: References: <20260614081052.1332702-1-harshit.m.mogalapalli@oracle.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: On Tue, Jun 16, 2026 at 11:51:53AM +0200, Luca Ceresoli wrote: > Issue 2: in mtd_virt_concat_destroy_joins(): > > list_for_each_entry_safe(item, tmp, &concat_node_list, head) { > mtd = &item->concat->mtd; [0] > if (item->concat) { [1] > > At line [0] we dereference item->concat, but at line [1] we apparently > handle the case where item->concat can be NULL. Either [1] is always true > and we can remove the if(), or [1] can be false, so [0] is a bug and should > probably be moved to inside the if(). That's not a dereference on line 0, it's pointer math. So the code works. But a lot of people find the distinction confusing. regards, dan carpenter