[NTFS] Fix use after free in failure case of NtfsMountVolume.

NtfsGetVolumeData frees FileRecLookasideList in case of failure, so don't
free it again.
Dereferencing NewDeviceObject invalidates Vcb.

diff --git a/drivers/filesystems/ntfs/fsctl.c b/drivers/filesystems/ntfs/fsctl.c
index a8c2a42..a08a227 100644 (file)
--- a/drivers/filesystems/ntfs/fsctl.c
+++ b/drivers/filesystems/ntfs/fsctl.c
@@ -452,8 +452,6 @@ NtfsMountVolume(PDEVICE_OBJECT DeviceObject,
     if (!NT_SUCCESS(Status))
         goto ByeBye;
 
-    Lookaside = TRUE;
-
     NewDeviceObject->Flags |= DO_DIRECT_IO;
     Vcb = (PVOID)NewDeviceObject->DeviceExtension;
     RtlZeroMemory(Vcb, sizeof(NTFS_VCB));
@@ -466,6 +464,8 @@ NtfsMountVolume(PDEVICE_OBJECT DeviceObject,
     if (!NT_SUCCESS(Status))
         goto ByeBye;
 
+    Lookaside = TRUE;
+
     NewDeviceObject->Vpb = DeviceToMount->Vpb;
 
     Vcb->StorageDevice = DeviceToMount;
@@ -564,11 +564,11 @@ ByeBye:
         if (Ccb)
             ExFreePool(Ccb);
 
-        if (NewDeviceObject)
-            IoDeleteDevice(NewDeviceObject);
-
         if (Lookaside)
             ExDeleteNPagedLookasideList(&Vcb->FileRecLookasideList);
+
+        if (NewDeviceObject)
+            IoDeleteDevice(NewDeviceObject);
     }
 
     DPRINT("NtfsMountVolume() done (Status: %lx)\n", Status);