ubifs: fix possible dereference after free

BoardzMaster · richardweinberger · commit d81efd66106c · 2023-10-28T23:18:12.000+02:00
'old_idx' could be dereferenced after free via 'rb_link_node' function call. Fixes: b5fda08 ("ubifs: Fix memleak when insert_old_idx() failed") Co-developed-by: Ivanov Mikhail <ivanov.mikhail1@huawei-partners.com> Signed-off-by: Konstantin Meskhidze <konstantin.meskhidze@huawei.com> Reviewed-by: Zhihao Cheng <chengzhihao1@huawei.com> Signed-off-by: Richard Weinberger <richard@nod.at>
diff --git a/fs/ubifs/tnc.c b/fs/ubifs/tnc.c
@@ -65,6 +65,7 @@ static void do_insert_old_idx(struct ubifs_info *c,
 		else {
 			ubifs_err(c, "old idx added twice!");
 			kfree(old_idx);
+			return;
 		}
 	}
 	rb_link_node(&old_idx->rb, parent, p);

Original file line number	Diff line number	Diff line change
`@@ -65,6 +65,7 @@ static void do_insert_old_idx(struct ubifs_info *c,`
`65`	`65`	`else {`
`66`	`66`	`ubifs_err(c, "old idx added twice!");`
`67`	`67`	`kfree(old_idx);`
	`68`	`+ return;`
`68`	`69`	`}`
`69`	`70`	`}`
`70`	`71`	`rb_link_node(&old_idx->rb, parent, p);`