fs/ntfs3: Fix invalid free in log_replay

log_read_rst() returns ENOMEM error when there is not enough memory.
In this case, if info is returned without initialization,
it attempts to kfree the uninitialized info->r_page pointer. This patch
moves the memset initialization code to before log_read_rst() is called.

Reported-by: Gerald Lee <sundaywind2004@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>

diff --git a/fs/ntfs3/fslog.c b/fs/ntfs3/fslog.c
index 915f42cf07bcf85deee4a0ab7b74a985d18a9328..49b7df6167785d44d811151d84283b16ba744188 100644 (file)
--- a/fs/ntfs3/fslog.c
+++ b/fs/ntfs3/fslog.c
@@ -1185,8 +1185,6 @@ static int log_read_rst(struct ntfs_log *log, u32 l_size, bool first,
        if (!r_page)
                return -ENOMEM;
 
-       memset(info, 0, sizeof(struct restart_info));
-
        /* Determine which restart area we are looking for. */
        if (first) {
                vbo = 0;
@@ -3791,10 +3789,11 @@ int log_replay(struct ntfs_inode *ni, bool *initialized)
        if (!log)
                return -ENOMEM;
 
+       memset(&rst_info, 0, sizeof(struct restart_info));
+
        log->ni = ni;
        log->l_size = l_size;
        log->one_page_buf = kmalloc(page_size, GFP_NOFS);
-
        if (!log->one_page_buf) {
                err = -ENOMEM;
                goto out;
@@ -3842,6 +3841,7 @@ int log_replay(struct ntfs_inode *ni, bool *initialized)
        if (rst_info.vbo)
                goto check_restart_area;
 
+       memset(&rst_info2, 0, sizeof(struct restart_info));
        err = log_read_rst(log, l_size, false, &rst_info2);
 
        /* Determine which restart area to use. */