diff options
| author | Namjae Jeon <linkinjeon@kernel.org> | 2025-04-01 13:50:39 +0900 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2026-09-02 14:29:16 +0200 |
| commit | ac65f76db9b2ff3fbc9e198c0e9aaf81b111b7d0 (patch) | |
| tree | e06d94f89e1aeccef5dbf03af670d2abdc8f56e3 | |
| parent | a39f811a9f5edb6d97bede8e6fe730393d3c8537 (diff) | |
| download | linux-stable-ac65f76db9b2ff3fbc9e198c0e9aaf81b111b7d0.tar.gz linux-stable-ac65f76db9b2ff3fbc9e198c0e9aaf81b111b7d0.zip | |
exfat: fix double free in delayed_free
[ Upstream commit 1f3d9724e16d62c7d42c67d6613b8512f2887c22 ]
The double free could happen in the following path.
exfat_create_upcase_table()
exfat_create_upcase_table() : return error
exfat_free_upcase_table() : free ->vol_utbl
exfat_load_default_upcase_table : return error
exfat_kill_sb()
delayed_free()
exfat_free_upcase_table() <--------- double free
This patch set ->vol_util as NULL after freeing it.
Reported-by: Jianzhou Zhao <xnxc22xnxc22@qq.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
| -rw-r--r-- | fs/exfat/nls.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/fs/exfat/nls.c b/fs/exfat/nls.c index 705710f93e2d..0e05c6b5a286 100644 --- a/fs/exfat/nls.c +++ b/fs/exfat/nls.c @@ -804,4 +804,5 @@ load_default: void exfat_free_upcase_table(struct exfat_sb_info *sbi) { kvfree(sbi->vol_utbl); + sbi->vol_utbl = NULL; } |