[PATCH] ovl: Fix possible NULL pointer dereference in ovl_destroy_inode
From: sunliming
Date: Tue Apr 21 2026 - 05:25:02 EST
From: sunliming <sunliming@xxxxxxxxxx>
In the ovl_destroy_inode function, a variable reference oi->lowerdata_redirect
that might be NULL is directly freed. Add a non-null check, and only free
the space when it is not NULL.
Signed-off-by: sunliming <sunliming@xxxxxxxxxx>
---
fs/overlayfs/super.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
index 60f0b7ceef0a..4b8b5fd4ab59 100644
--- a/fs/overlayfs/super.c
+++ b/fs/overlayfs/super.c
@@ -218,7 +218,7 @@ static void ovl_destroy_inode(struct inode *inode)
ovl_stack_put(ovl_lowerstack(oi->oe), ovl_numlower(oi->oe));
if (S_ISDIR(inode->i_mode))
ovl_dir_cache_free(inode);
- else
+ else if (oi->lowerdata_redirect)
kfree(oi->lowerdata_redirect);
}
--
2.25.1