Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

fs/ntfs3: fix potential double iput on d_make_root() failure

d_make_root() consumes the reference to the passed inode: it either
attaches it to the newly created dentry on success, or drops it via
iput() on failure.

In the error path, the code currently does:
sb->s_root = d_make_root(inode);
if (!sb->s_root)
goto put_inode_out;

which leads to a second iput(inode) in put_inode_out. This results in
a double iput and may trigger a use-after-free if the inode gets freed
after the first iput().

Fix this by jumping directly to the common cleanup path, avoiding the
extra iput(inode).

Signed-off-by: Zhan Xusheng <zhanxusheng@xiaomi.com>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>

authored by

Zhan Xusheng and committed by
Konstantin Komarov
d1062683 984a415f

+1 -1
+1 -1
fs/ntfs3/super.c
··· 1704 1704 sb->s_root = d_make_root(inode); 1705 1705 if (!sb->s_root) { 1706 1706 err = -ENOMEM; 1707 - goto put_inode_out; 1707 + goto out; 1708 1708 } 1709 1709 1710 1710 if (boot2) {