CVE-2024-50088 Information

Description

In the Linux kernel the following vulnerability has been resolved:

btrfs: fix uninitialized pointer free in add_inode_ref()

The add_inode_ref() function does not initialize the ame\ struct when it is declared. If any of the following calls to ead_one_inode() returns NULL

dir = read_one_inode(root parent_objectid);
if (!dir) 
	ret = -ENOENT;
	goto out;


inode = read_one_inode(root inode_objectid);
if (!inode) 
	ret = -EIO;
	goto out;

then ame.name\ would be freed on \out\ before being initialized.

out: … kfree(name.name);

This issue was reported by Coverity with CID 1526744.

Reference

https://git.kernel.org/stable/c/12cf028381aa19bc38465341512c280256e8d82d https://git.kernel.org/stable/c/e11ce03b58743bf1e096c48fcaa7e6f08eb75dfa https://git.kernel.org/stable/c/a941f3d5b1469c60a7e70e775584f110b47e0d16 https://git.kernel.org/stable/c/66691c6e2f18d2aa4b22ffb624b9bdc97e9979e4