github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

ntfs: NULL vol->vol_ino in the load_system_files() error teardown

Browse Source 
The error unwind of load_system_files() drops vol->vol_ino on two
paths but leaves the stale pointer in place while it keeps iput()ing
the remaining system inodes ($Bitmap, $MFT bitmap, $MFTMirr; $MFT
itself is dropped by the caller, ntfs_fill_super()).  A third path
carried an iput() that can never execute: it sits inside the
IS_ERR(vol->vol_ino) branch guarded by !IS_ERR(vol->vol_ino), and is
removed along with the stale pointers.  Nothing in the teardown
dereferences vol_ino today, so this is pure hygiene, but a stale
pointer to a freed inode surviving the unwind is a trap for any
future code walking the volume during teardown.

ntfs_put_super() and the ntfs_fill_super() error path already NULL it
after their iput(); do the same here.

Cc: stable@vger.kernel.org
Signed-off-by: Hongling Zeng <zenghongling@kylinos.cn>
Reviewed-by: Baolin Liu <liubaolin@kylinos.cn>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
This commit is contained in:
Hongling Zeng 2026-09-07 15:08:52 +08:00 committed by Namjae Jeon
parent 406747e46d
commit a0c022c1da
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
fs/ntfs/super.c
View File

@ -1536,8 +1536,7 @@ static bool load_system_files(struct ntfs_volume *vol)
*/
vol->vol_ino = ntfs_iget(sb, FILE_Volume);
if (IS_ERR(vol->vol_ino)) {
if (!IS_ERR(vol->vol_ino))
iput(vol->vol_ino);
vol->vol_ino = NULL;
volume_failed:
ntfs_error(sb, "Failed to load $Volume.");
goto iput_lcnbmp_err_out;
@ -1546,6 +1545,7 @@ static bool load_system_files(struct ntfs_volume *vol)
if (IS_ERR(m)) {
iput_volume_failed:
iput(vol->vol_ino);
vol->vol_ino = NULL;
goto volume_failed;
}
@ -1706,6 +1706,8 @@ static bool load_system_files(struct ntfs_volume *vol)
if (vol->logfile_ino)
iput(vol->logfile_ino);
iput(vol->vol_ino);
/* Do not leave a stale pointer behind for the rest of the teardown. */
vol->vol_ino = NULL;
iput_lcnbmp_err_out:
iput(vol->lcnbmp_ino);
iput_attrdef_err_out: