James Kim 16f6588a3b mtd: docg3: fix use-after-free in docg3_release() ...

commit ca19808bc6 upstream.

In docg3_release(), the docg3 pointer is obtained from
cascade->floors[0]->priv before the loop that calls
doc_release_device() on each floor. doc_release_device() frees the
docg3 struct via kfree(docg3) at line 1881. After the loop,
docg3->cascade->bch dereferences the already-freed pointer.

Fix this by accessing cascade->bch directly, which is equivalent
since docg3->cascade points back to the same cascade struct, and
is already available as a local variable. This also removes the
now-unused docg3 local variable.

Fixes: c8ae3f744d ("lib/bch: Rework a little bit the exported function names")
Cc: stable@vger.kernel.org
Signed-off-by: James Kim <james010kim@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2026-05-07 06:09:30 +02:00

..

bcm47xxsflash.c

…

bcm47xxsflash.h

…

block2mtd.c

…

docg3.c

…

docg3.h

…

Kconfig

…

Makefile

…

mchp23k256.c

…

mchp48l640.c

…

ms02-nv.c

…

ms02-nv.h

…

mtd_dataflash.c

…

mtdram.c

…

phram.c

…

pmc551.c

…

powernv_flash.c

…

serial_flash_cmds.h

…

slram.c

…

spear_smi.c

…

sst25l.c

…

st_spi_fsm.c

…