5.15-stable patches

added patches:
	fs-ntfs3-fix-invalid-free-in-log_replay.patch

diff --git a/queue-5.15/fs-ntfs3-fix-invalid-free-in-log_replay.patch b/queue-5.15/fs-ntfs3-fix-invalid-free-in-log_replay.patch
new file mode 100644 (file)
index 0000000..951a221
--- /dev/null
+++ b/queue-5.15/fs-ntfs3-fix-invalid-free-in-log_replay.patch
@@ -0,0 +1,54 @@
+From f26967b9f7a830e228bb13fb41bd516ddd9d789d Mon Sep 17 00:00:00 2001
+From: Namjae Jeon <linkinjeon@kernel.org>
+Date: Mon, 30 May 2022 18:43:01 +0300
+Subject: fs/ntfs3: Fix invalid free in log_replay
+
+From: Namjae Jeon <linkinjeon@kernel.org>
+
+commit f26967b9f7a830e228bb13fb41bd516ddd9d789d upstream.
+
+log_read_rst() returns ENOMEM error when there is not enough memory.
+In this case, if info is returned without initialization,
+it attempts to kfree the uninitialized info->r_page pointer. This patch
+moves the memset initialization code to before log_read_rst() is called.
+
+Reported-by: Gerald Lee <sundaywind2004@gmail.com>
+Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/ntfs3/fslog.c |    6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/fs/ntfs3/fslog.c
++++ b/fs/ntfs3/fslog.c
+@@ -1185,8 +1185,6 @@ static int log_read_rst(struct ntfs_log
+       if (!r_page)
+               return -ENOMEM;
+ 
+-      memset(info, 0, sizeof(struct restart_info));
+-
+       /* Determine which restart area we are looking for. */
+       if (first) {
+               vbo = 0;
+@@ -3791,10 +3789,11 @@ int log_replay(struct ntfs_inode *ni, bo
+       if (!log)
+               return -ENOMEM;
+ 
++      memset(&rst_info, 0, sizeof(struct restart_info));
++
+       log->ni = ni;
+       log->l_size = l_size;
+       log->one_page_buf = kmalloc(page_size, GFP_NOFS);
+-
+       if (!log->one_page_buf) {
+               err = -ENOMEM;
+               goto out;
+@@ -3842,6 +3841,7 @@ int log_replay(struct ntfs_inode *ni, bo
+       if (rst_info.vbo)
+               goto check_restart_area;
+ 
++      memset(&rst_info2, 0, sizeof(struct restart_info));
+       err = log_read_rst(log, l_size, false, &rst_info2);
+ 
+       /* Determine which restart area to use. */

diff --git a/queue-5.15/series b/queue-5.15/series
index a4bc9e4612d811fa4c43ee941f6c8d41b98ad335..5fd6f41443743c5377e3cd106ffc663998e03d7e 100644 (file)
--- a/queue-5.15/series
+++ b/queue-5.15/series
@@ -661,3 +661,4 @@ interconnect-qcom-sc7180-drop-ip0-interconnects.patch
 interconnect-qcom-icc-rpmh-add-bcms-to-commit-list-in-pre_aggregate.patch
 fs-add-two-trivial-lookup-helpers.patch
 exportfs-support-idmapped-mounts.patch
+fs-ntfs3-fix-invalid-free-in-log_replay.patch