exfat: Fix potential use after free in exfat_load_upcase_table()

Dan Carpenter · namjaejeon · commit fc961522ddbd · 2020-06-09T16:50:18.000+09:00
This code calls brelse(bh) and then dereferences "bh" on the next line resulting in a possible use after free. The brelse() should just be moved down a line. Fixes: b676fdb ("exfat: standardize checksum calculation") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Namjae Jeon <namjae.jeon@samsung.com>
diff --git a/fs/exfat/nls.c b/fs/exfat/nls.c
@@ -692,8 +692,8 @@ static int exfat_load_upcase_table(struct super_block *sb,
 				index++;
 			}
 		}
-		brelse(bh);
 		chksum = exfat_calc_chksum32(bh->b_data, i, chksum, CS_DEFAULT);
+		brelse(bh);
 	}
 
 	if (index >= 0xFFFF && utbl_checksum == chksum)

Original file line number	Diff line number	Diff line change
`@@ -692,8 +692,8 @@ static int exfat_load_upcase_table(struct super_block *sb,`
`692`	`692`	`index++;`
`693`	`693`	`}`
`694`	`694`	`}`
`695`		`- brelse(bh);`
`696`	`695`	`chksum = exfat_calc_chksum32(bh->b_data, i, chksum, CS_DEFAULT);`
	`696`	`+ brelse(bh);`
`697`	`697`	`}`
`698`	`698`
`699`	`699`	`if (index >= 0xFFFF && utbl_checksum == chksum)`