Commit d106268
fs/ntfs3: fix potential double iput on d_make_root() failure
d_make_root() consumes the reference to the passed inode: it either
attaches it to the newly created dentry on success, or drops it via
iput() on failure.
In the error path, the code currently does:
sb->s_root = d_make_root(inode);
if (!sb->s_root)
goto put_inode_out;
which leads to a second iput(inode) in put_inode_out. This results in
a double iput and may trigger a use-after-free if the inode gets freed
after the first iput().
Fix this by jumping directly to the common cleanup path, avoiding the
extra iput(inode).
Signed-off-by: Zhan Xusheng <zhanxusheng@xiaomi.com>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>1 parent 984a415 commit d106268
1 file changed
Lines changed: 1 addition & 1 deletion
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
1704 | 1704 | | |
1705 | 1705 | | |
1706 | 1706 | | |
1707 | | - | |
| 1707 | + | |
1708 | 1708 | | |
1709 | 1709 | | |
1710 | 1710 | | |
| |||
0 commit comments