moonjuice/kernel_arpi
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fs/ntfs3: Fix invalid free in log_replay

Browse Source 
commit f26967b9f7a830e228bb13fb41bd516ddd9d789d upstream.

log_read_rst() returns ENOMEM error when there is not enough memory.
In this case, if info is returned without initialization,
it attempts to kfree the uninitialized info->r_page pointer. This patch
moves the memset initialization code to before log_read_rst() is called.

Reported-by: Gerald Lee <sundaywind2004@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Namjae Jeon
2022-05-30 18:43:01 +03:00
committed by Greg Kroah-Hartman
parent 00f1de9cff
commit 61decb5848
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
fs/ntfs3/fslog.c
View File

@@ -1185,8 +1185,6 @@ static int log_read_rst(struct ntfs_log *log, u32 l_size, bool first,
if (!r_page) if (!r_page)
return -ENOMEM; return -ENOMEM;
memset(info, 0, sizeof(struct restart_info));
/* Determine which restart area we are looking for. */ /* Determine which restart area we are looking for. */
if (first) { if (first) {
vbo = 0; vbo = 0;
@@ -3791,10 +3789,11 @@ int log_replay(struct ntfs_inode *ni, bool *initialized)
if (!log) if (!log)
return -ENOMEM; return -ENOMEM;
memset(&rst_info, 0, sizeof(struct restart_info));
log->ni = ni; log->ni = ni;
log->l_size = l_size; log->l_size = l_size;
log->one_page_buf = kmalloc(page_size, GFP_NOFS); log->one_page_buf = kmalloc(page_size, GFP_NOFS);
if (!log->one_page_buf) { if (!log->one_page_buf) {
err = -ENOMEM; err = -ENOMEM;
goto out; goto out;
@@ -3842,6 +3841,7 @@ int log_replay(struct ntfs_inode *ni, bool *initialized)
if (rst_info.vbo) if (rst_info.vbo)
goto check_restart_area; goto check_restart_area;
memset(&rst_info2, 0, sizeof(struct restart_info));
err = log_read_rst(log, l_size, false, &rst_info2); err = log_read_rst(log, l_size, false, &rst_info2);
/* Determine which restart area to use. */ /* Determine which restart area to use. */