Commit c105e76b authored by Dan Carpenter's avatar Dan Carpenter Committed by Viacheslav Dubeyko
Browse files

hfs: fix potential use after free in hfs_correct_next_unused_CNID() 



This code calls hfs_bnode_put(node) which drops the refcount and then
dreferences "node" on the next line.  It's only safe to use "node"
when we're holding a reference so flip these two lines around.

Fixes: a06ec283 ("hfs: add logic of correcting a next unused CNID")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: default avatarViacheslav Dubeyko <slava@dubeyko.com>
Signed-off-by: default avatarViacheslav Dubeyko <slava@dubeyko.com>
Link: https://lore.kernel.org/r/aN-Xw8KnbSnuIcLk@stanley.mountain


Signed-off-by: default avatarViacheslav Dubeyko <slava@dubeyko.com>
parent 3a866087

fs/hfs/catalog.c

+1 −1
Original line number Diff line number Diff line
@@ -322,9 +322,9 @@ int hfs_correct_next_unused_CNID(struct super_block *sb, u32 cnid) 
			}

		}



		node_id = node->prev;

		hfs_bnode_put(node);



		node_id = node->prev;

	} while (node_id >= leaf_head);



	return -ENOENT;