Commit 382b1e8f30f7 ("kernfs: fix memory leak of kernfs_iattrs in __kernfs_new_node") introduced an err_out4 error path which frees iattr when security_kernfs_init_security() fails. However, iattr is only allocated by __kernfs_setattr() when the node has non-default uid/gid. If the node uses default ownership, iattr remains NULL, and security_kernfs_init_security() failure would cause a NULL pointer dereference when err_out4 tries to access kn->iattr->xattrs. Add a NULL check before freeing iattr. Fixes: 382b1e8f30f7 ("kernfs: fix memory leak of kernfs_iattrs in __kernfs_new_node") Cc: stable@vger.kernel.org Reported-by: ζœδΉ‰ζ’ Signed-off-by: Tejun Heo --- fs/kernfs/dir.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/fs/kernfs/dir.c b/fs/kernfs/dir.c index 5c0efd6b239f..29baeeb97871 100644 --- a/fs/kernfs/dir.c +++ b/fs/kernfs/dir.c @@ -681,8 +681,10 @@ static struct kernfs_node *__kernfs_new_node(struct kernfs_root *root, return kn; err_out4: - simple_xattrs_free(&kn->iattr->xattrs, NULL); - kmem_cache_free(kernfs_iattrs_cache, kn->iattr); + if (kn->iattr) { + simple_xattrs_free(&kn->iattr->xattrs, NULL); + kmem_cache_free(kernfs_iattrs_cache, kn->iattr); + } err_out3: spin_lock(&root->kernfs_idr_lock); idr_remove(&root->ino_idr, (u32)kernfs_ino(kn)); -- 2.47.2