]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
hfs: fix potential use after free in hfs_correct_next_unused_CNID()
authorDan Carpenter <dan.carpenter@linaro.org>
Fri, 3 Oct 2025 09:30:43 +0000 (12:30 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 18 Dec 2025 13:02:52 +0000 (14:02 +0100)
commit40a1e0142096dd7dd6cb5373841222b528698588
treeb95dd0e0fa7d39e7bd7ae92bfc57f54f28d6aa03
parentba2726d43d3b33c36a75707086c15c35afcbb82e
hfs: fix potential use after free in hfs_correct_next_unused_CNID()

[ Upstream commit c105e76bb17cf4b55fe89c6ad4f6a0e3972b5b08 ]

This code calls hfs_bnode_put(node) which drops the refcount and then
dreferences "node" on the next line.  It's only safe to use "node"
when we're holding a reference so flip these two lines around.

Fixes: a06ec283e125 ("hfs: add logic of correcting a next unused CNID")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Viacheslav Dubeyko <slava@dubeyko.com>
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
Link: https://lore.kernel.org/r/aN-Xw8KnbSnuIcLk@stanley.mountain
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
fs/hfs/catalog.c