Re: [PATCH] ovl: Fix possible NULL pointer dereference in ovl_destroy_inode

[Amir Goldstein]

On Tue, Apr 21, 2026 at 11:24 AM <sunliming@xxxxxxxxx> wrote:
>
> From: sunliming <sunliming@xxxxxxxxxx>
>
> In the ovl_destroy_inode function, a variable reference oi->lowerdata_redirect
> that might be NULL is directly freed. Add a non-null check, and only free
> the space when it is not NULL.

Sunliming,

This is nonsense.
kfree() is not a dereference and kfree(NULL) is allowed.

Please be more considerate of my time and the time of other
volunteer maintainers and do not post patches that you do not
understand yourself.

Thanks,
Amir.

>
> Signed-off-by: sunliming <sunliming@xxxxxxxxxx>
> ---
>  fs/overlayfs/super.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
> index 60f0b7ceef0a..4b8b5fd4ab59 100644
> --- a/fs/overlayfs/super.c
> +++ b/fs/overlayfs/super.c
> @@ -218,7 +218,7 @@ static void ovl_destroy_inode(struct inode *inode)
>         ovl_stack_put(ovl_lowerstack(oi->oe), ovl_numlower(oi->oe));
>         if (S_ISDIR(inode->i_mode))
>                 ovl_dir_cache_free(inode);
> -       else
> +       else if (oi->lowerdata_redirect)
>                 kfree(oi->lowerdata_redirect);
>  }
>
> --
> 2.25.1
>