diff options
| author | YangWen <anmuxixixi@gmail.com> | 2025-09-10 23:17:08 +0800 |
|---|---|---|
| committer | Konstantin Komarov <almaz.alexandrovich@paragon-software.com> | 2025-10-17 16:45:37 +0200 |
| commit | 02f312754c873efe076888a2fdca982e56617929 (patch) | |
| tree | e5d7187b67c5d052e593392c4faa3f51592fca9e /scripts/lib/kdoc/kdoc_parser.py | |
| parent | 68f6bd128e75a032432eda9d16676ed2969a1096 (diff) | |
ntfs3: fix use-after-free of sbi->options in cmp_fnames
The root cause is that sbi->options points directly to fc->fs_private.
If fc->fs_private is freed while sbi still exists, sbi->options becomes
a dangling pointer.
This patch ensures that sbi->options is a separate copy of fc->fs_private
and duplicates nls_name if present. On superblock release or error,
sbi->options->nls_name and sbi->options are freed and sbi->options
is set to NULL to avoid any dangling pointer.
Reported-by: syzbot+d77c546c60db651a389c@syzkaller.appspotmail.com
Signed-off-by: YangWen <anmuxixixi@gmail.com>
[almaz.alexandrovich@paragon-software.com: remove syzbot logs from description]
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Diffstat (limited to 'scripts/lib/kdoc/kdoc_parser.py')
0 files changed, 0 insertions, 0 deletions