Commit 8c16c1c0 authored by DaeMyung Kang's avatar DaeMyung Kang Committed by Namjae Jeon
Browse files

ntfs: fix empty_buf and ra lifetime bugs in ntfs_empty_logfile() 



ntfs_empty_logfile() has three related allocator bugs around the
@empty_buf and @ra buffers it uses inside the per-cluster loop.

When the loop encounters a runlist entry with LCN_RL_NOT_MAPPED, the
function kvfrees @empty_buf and goes to map_vcn to remap.  @empty_buf
is not cleared.  If ntfs_map_runlist_nolock() fails on re-entry,
control jumps to the err label which kvfrees @empty_buf a second time.

In the same branch, @ra is left allocated.  When the remap succeeds
the function falls through the @empty_buf re-allocation and the @ra
re-allocation, overwriting the previous @ra pointer and leaking it.

The success path frees @empty_buf with kfree() instead of kvfree().
kvzalloc() may fall back to vmalloc(), in which case kfree() does not
correctly release the memory.

A KASAN-enabled QEMU harness mirroring this control flow reports
"BUG: KASAN: double-free" when the second ntfs_map_runlist_nolock()
fails.

Clear both @empty_buf and @ra after the in-loop releases so the err
path is a no-op when the buffers have already been freed and so the
remap-success path does not leak the previous @ra.  Switch the success
path to kvfree() to match the @empty_buf allocator.

Fixes: 5218cd10 ("ntfs: update misc operations")
Signed-off-by: default avatarDaeMyung Kang <charsyam@gmail.com>
Signed-off-by: default avatarNamjae Jeon <linkinjeon@kernel.org>
parent b64f0ae5

fs/ntfs/logfile.c

+4 −1
Original line number Diff line number Diff line
@@ -710,6 +710,9 @@ bool ntfs_empty_logfile(struct inode *log_vi) 
		if (unlikely(lcn == LCN_RL_NOT_MAPPED)) {

			vcn = rl->vcn;

			kvfree(empty_buf);

			empty_buf = NULL;

			kfree(ra);

			ra = NULL;

			goto map_vcn;

		}

		/* If this run is not valid abort with an error. */
@@ -753,7 +756,7 @@ bool ntfs_empty_logfile(struct inode *log_vi) 
		} while (start < end);

	} while ((++rl)->vcn < end_vcn);

	up_write(&log_ni->runlist.lock);

	kfree(empty_buf);

	kvfree(empty_buf);

	kfree(ra);

	truncate_inode_pages(log_vi->i_mapping, 0);

	/* Set the flag so we do not have to do it again on remount. */