Commit 1f3d9724 authored by Namjae Jeon's avatar Namjae Jeon
Browse files

exfat: fix double free in delayed_free 



The double free could happen in the following path.

exfat_create_upcase_table()
        exfat_create_upcase_table() : return error
        exfat_free_upcase_table() : free ->vol_utbl
        exfat_load_default_upcase_table : return error
     exfat_kill_sb()
           delayed_free()
                  exfat_free_upcase_table() <--------- double free
This patch set ->vol_util as NULL after freeing it.

Reported-by: default avatarJianzhou Zhao <xnxc22xnxc22@qq.com>
Signed-off-by: default avatarNamjae Jeon <linkinjeon@kernel.org>
parent 0ff41df1

fs/exfat/nls.c

+1 −0
Original line number Diff line number Diff line
@@ -801,4 +801,5 @@ int exfat_create_upcase_table(struct super_block *sb) 
void exfat_free_upcase_table(struct exfat_sb_info *sbi)

{

	kvfree(sbi->vol_utbl);

	sbi->vol_utbl = NULL;

}