From: Lucas Martins Alves <[email protected]> When jffs2_free_cache() releases the memory allocated for pL (the JFFS2 private list structure), part->jffs2_priv was not cleared. This left part->jffs2_priv as a dangling pointer to freed memory, which could lead to use-after-free or double-free issues if jffs2_free_cache() or other JFFS2 functions were subsequently called on the same partition.
Set part->jffs2_priv to NULL after freeing pL to ensure clean state. Signed-off-by: Lucas Martins Alves <[email protected]> --- fs/jffs2/jffs2_1pass.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/jffs2/jffs2_1pass.c b/fs/jffs2/jffs2_1pass.c index 137a9585b0b..3c06817955b 100644 --- a/fs/jffs2/jffs2_1pass.c +++ b/fs/jffs2/jffs2_1pass.c @@ -647,6 +647,7 @@ jffs2_free_cache(struct part_info *part) free_nodes(&pL->dir); free(pL->readbuf); free(pL); + part->jffs2_priv = NULL; } } -- 2.53.0
