diff options
| author | Namjae Jeon <linkinjeon@kernel.org> | 2022-05-30 18:43:01 +0300 |
|---|---|---|
| committer | Konstantin Komarov <almaz.alexandrovich@paragon-software.com> | 2022-05-31 17:29:29 +0300 |
| commit | f26967b9f7a830e228bb13fb41bd516ddd9d789d (patch) | |
| tree | b5ba4fcc3c18f14c8695cc89c4032e4862921a65 /fs | |
| parent | 03ab8e6297acd1bc0eedaa050e2a1635c576fd11 (diff) | |
| download | linux-f26967b9f7a830e228bb13fb41bd516ddd9d789d.tar.bz2 | |
fs/ntfs3: Fix invalid free in log_replay
log_read_rst() returns ENOMEM error when there is not enough memory.
In this case, if info is returned without initialization,
it attempts to kfree the uninitialized info->r_page pointer. This patch
moves the memset initialization code to before log_read_rst() is called.
Reported-by: Gerald Lee <sundaywind2004@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Diffstat (limited to 'fs')
| -rw-r--r-- | fs/ntfs3/fslog.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/fs/ntfs3/fslog.c b/fs/ntfs3/fslog.c index 915f42cf07bc..49b7df616778 100644 --- a/fs/ntfs3/fslog.c +++ b/fs/ntfs3/fslog.c @@ -1185,8 +1185,6 @@ static int log_read_rst(struct ntfs_log *log, u32 l_size, bool first, if (!r_page) return -ENOMEM; - memset(info, 0, sizeof(struct restart_info)); - /* Determine which restart area we are looking for. */ if (first) { vbo = 0; @@ -3791,10 +3789,11 @@ int log_replay(struct ntfs_inode *ni, bool *initialized) if (!log) return -ENOMEM; + memset(&rst_info, 0, sizeof(struct restart_info)); + log->ni = ni; log->l_size = l_size; log->one_page_buf = kmalloc(page_size, GFP_NOFS); - if (!log->one_page_buf) { err = -ENOMEM; goto out; @@ -3842,6 +3841,7 @@ int log_replay(struct ntfs_inode *ni, bool *initialized) if (rst_info.vbo) goto check_restart_area; + memset(&rst_info2, 0, sizeof(struct restart_info)); err = log_read_rst(log, l_size, false, &rst_info2); /* Determine which restart area to use. */ |