Unverified Commit f26967b9 authored by Namjae Jeon's avatar Namjae Jeon Committed by Konstantin Komarov
Browse files

fs/ntfs3: Fix invalid free in log_replay 



log_read_rst() returns ENOMEM error when there is not enough memory.
In this case, if info is returned without initialization,
it attempts to kfree the uninitialized info->r_page pointer. This patch
moves the memset initialization code to before log_read_rst() is called.

Reported-by: default avatarGerald Lee <sundaywind2004@gmail.com>
Signed-off-by: default avatarNamjae Jeon <linkinjeon@kernel.org>
Signed-off-by: default avatarKonstantin Komarov <almaz.alexandrovich@paragon-software.com>
parent 03ab8e62

fs/ntfs3/fslog.c

+3 −3
Original line number Diff line number Diff line
@@ -1185,8 +1185,6 @@ static int log_read_rst(struct ntfs_log *log, u32 l_size, bool first, 
	if (!r_page)

		return -ENOMEM;



	memset(info, 0, sizeof(struct restart_info));



	/* Determine which restart area we are looking for. */

	if (first) {

		vbo = 0;
@@ -3791,10 +3789,11 @@ int log_replay(struct ntfs_inode *ni, bool *initialized) 
	if (!log)

		return -ENOMEM;



	memset(&rst_info, 0, sizeof(struct restart_info));



	log->ni = ni;

	log->l_size = l_size;

	log->one_page_buf = kmalloc(page_size, GFP_NOFS);



	if (!log->one_page_buf) {

		err = -ENOMEM;

		goto out;
@@ -3842,6 +3841,7 @@ int log_replay(struct ntfs_inode *ni, bool *initialized) 
	if (rst_info.vbo)

		goto check_restart_area;



	memset(&rst_info2, 0, sizeof(struct restart_info));

	err = log_read_rst(log, l_size, false, &rst_info2);



	/* Determine which restart area to use. */