]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
exfat: fix double free in delayed_free
authorNamjae Jeon <linkinjeon@kernel.org>
Tue, 1 Apr 2025 04:50:39 +0000 (13:50 +0900)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 27 Jun 2025 10:05:28 +0000 (11:05 +0100)
commit66e84439ec2af776ce749e8540f8fdd257774152
tree38f561bc7c3a220da4348191410badc09b90f0ad
parent3742e777735ab1ade3a66061c8f8c2decb9f6bb7
exfat: fix double free in delayed_free

[ Upstream commit 1f3d9724e16d62c7d42c67d6613b8512f2887c22 ]

The double free could happen in the following path.

exfat_create_upcase_table()
        exfat_create_upcase_table() : return error
        exfat_free_upcase_table() : free ->vol_utbl
        exfat_load_default_upcase_table : return error
     exfat_kill_sb()
           delayed_free()
                  exfat_free_upcase_table() <--------- double free
This patch set ->vol_util as NULL after freeing it.

Reported-by: Jianzhou Zhao <xnxc22xnxc22@qq.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
fs/exfat/nls.c