]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
ntfs3: fix use-after-free of sbi->options in cmp_fnames
authorYangWen <anmuxixixi@gmail.com>
Wed, 10 Sep 2025 15:17:08 +0000 (23:17 +0800)
committerKonstantin Komarov <almaz.alexandrovich@paragon-software.com>
Fri, 17 Oct 2025 14:45:37 +0000 (16:45 +0200)
commit02f312754c873efe076888a2fdca982e56617929
treee5d7187b67c5d052e593392c4faa3f51592fca9e
parent68f6bd128e75a032432eda9d16676ed2969a1096
ntfs3: fix use-after-free of sbi->options in cmp_fnames

The root cause is that sbi->options points directly to fc->fs_private.
If fc->fs_private is freed while sbi still exists, sbi->options becomes
a dangling pointer.

This patch ensures that sbi->options is a separate copy of fc->fs_private
and duplicates nls_name if present. On superblock release or error,
sbi->options->nls_name and sbi->options are freed and sbi->options
is set to NULL to avoid any dangling pointer.

Reported-by: syzbot+d77c546c60db651a389c@syzkaller.appspotmail.com
Signed-off-by: YangWen <anmuxixixi@gmail.com>
[almaz.alexandrovich@paragon-software.com: remove syzbot logs from description]
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
fs/ntfs3/super.c