Skip to content

Commit aee4d5a

Browse files
anmuxixixiaalexandrovich
authored andcommitted
ntfs3: fix double free of sbi->options->nls and clarify ownership of fc->fs_private
commit 02f3127 ("ntfs3: fix use-after-free of sbi->options in cmp_fnames") introduced a use-after-free bug due to improper handling of sbi->options in error paths. This resulted in crashes when superblock cleanup is performed in ntfs_put_super. This patch ensures that the options structure and its subfields are properly freed, preventing the memory corruption and use-after-free errors. Fixes: 02f3127 ("ntfs3: fix use-after-free of sbi->options in cmp_fnames") Reported-by: syzbot+cc433e4cd6d54736bf80@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=cc433e4cd6d54736bf80 Signed-off-by: YangWen <anmuxixixi@gmail.com> [almaz.alexandrovich@paragon-software.com: added fixes and closes tags] Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
1 parent a8a3ca2 commit aee4d5a

1 file changed

Lines changed: 3 additions & 2 deletions

File tree

fs/ntfs3/super.c

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -705,7 +705,7 @@ static void ntfs_put_super(struct super_block *sb)
705705

706706
if (sbi->options) {
707707
unload_nls(sbi->options->nls);
708-
kfree(sbi->options->nls);
708+
kfree(sbi->options->nls_name);
709709
kfree(sbi->options);
710710
sbi->options = NULL;
711711
}
@@ -1251,6 +1251,7 @@ static int ntfs_fill_super(struct super_block *sb, struct fs_context *fc)
12511251
}
12521252
}
12531253
sbi->options = options;
1254+
fc->fs_private = NULL;
12541255
sb->s_flags |= SB_NODIRATIME;
12551256
sb->s_magic = 0x7366746e; // "ntfs"
12561257
sb->s_op = &ntfs_sops;
@@ -1676,7 +1677,7 @@ static int ntfs_fill_super(struct super_block *sb, struct fs_context *fc)
16761677
out:
16771678
if (sbi && sbi->options) {
16781679
unload_nls(sbi->options->nls);
1679-
kfree(sbi->options->nls);
1680+
kfree(sbi->options->nls_name);
16801681
kfree(sbi->options);
16811682
sbi->options = NULL;
16821683
}

0 commit comments

Comments
 (0)