exfat: fix double free in delayed_free
authorNamjae Jeon <linkinjeon@kernel.org>
Tue, 1 Apr 2025 04:50:39 +0000 (13:50 +0900)
committerNamjae Jeon <linkinjeon@kernel.org>
Mon, 26 May 2025 11:25:23 +0000 (20:25 +0900)
commit1f3d9724e16d62c7d42c67d6613b8512f2887c22
tree7c02a7f7436685110d384fcaedc6a22988bdac75
parent0ff41df1cb268fc69e703a08a57ee14ae967d0ca
exfat: fix double free in delayed_free

The double free could happen in the following path.

exfat_create_upcase_table()
        exfat_create_upcase_table() : return error
        exfat_free_upcase_table() : free ->vol_utbl
        exfat_load_default_upcase_table : return error
     exfat_kill_sb()
           delayed_free()
                  exfat_free_upcase_table() <--------- double free
This patch set ->vol_util as NULL after freeing it.

Reported-by: Jianzhou Zhao <xnxc22xnxc22@qq.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
fs/exfat/nls.c