Skip to content

Commit d106268

Browse files
Zhan Xushengaalexandrovich
authored andcommitted
fs/ntfs3: fix potential double iput on d_make_root() failure
d_make_root() consumes the reference to the passed inode: it either attaches it to the newly created dentry on success, or drops it via iput() on failure. In the error path, the code currently does: sb->s_root = d_make_root(inode); if (!sb->s_root) goto put_inode_out; which leads to a second iput(inode) in put_inode_out. This results in a double iput and may trigger a use-after-free if the inode gets freed after the first iput(). Fix this by jumping directly to the common cleanup path, avoiding the extra iput(inode). Signed-off-by: Zhan Xusheng <zhanxusheng@xiaomi.com> Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
1 parent 984a415 commit d106268

1 file changed

Lines changed: 1 addition & 1 deletion

File tree

fs/ntfs3/super.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1704,7 +1704,7 @@ static int ntfs_fill_super(struct super_block *sb, struct fs_context *fc)
17041704
sb->s_root = d_make_root(inode);
17051705
if (!sb->s_root) {
17061706
err = -ENOMEM;
1707-
goto put_inode_out;
1707+
goto out;
17081708
}
17091709

17101710
if (boot2) {

0 commit comments

Comments
 (0)