[PATCH 08/27] ext4: zero s_fc_replay_state in ext4_fc_replay_cleanup()

["Theodore Ts'o" <tytso@mit.edu>]

ext4_fc_replay_cleanup() frees sbi->s_fc_replay_state.fc_regions and
sbi->s_fc_replay_state.fc_modified_inodes, but leaves the dangling
pointers and non-zero size/usage counters in sbi->s_fc_replay_state.

This makes ext4_fc_replay_cleanup() non-idempotent: calling it more than
once triggers a slab double-free of fc_regions and fc_modified_inodes.
In particular, the ext4_fast_commit_test KUnit suite calls
ext4_fc_replay_cleanup() explicitly at the end of replay test cases and
again from its fc_cleanup_all() teardown action, causing SLUB
double-free errors in test_fc_replay_inode_and_dentries() and
test_fc_replay_ranges_and_end_to_end(). Leaving stale pointers and a
non-zero fc_regions_valid count in s_fc_replay_state after replay
completes also risks a use-after-free if ext4_fc_replay_check_excluded()
is ever invoked after cleanup, or a double-free if mount error paths are
updated to call ext4_fc_replay_cleanup().

Zero sbi->s_fc_replay_state in ext4_fc_replay_cleanup() after freeing
both buffers so the replay state is fully reset and repeated calls are
safe no-ops.

Fixes: 8016e29f4362 ("ext4: fast commit recovery path")
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
---
 fs/ext4/fast_commit.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/ext4/fast_commit.c b/fs/ext4/fast_commit.c
index 0cac890cf370..15bd040c2329 100644
--- a/fs/ext4/fast_commit.c
+++ b/fs/ext4/fast_commit.c
@@ -2398,6 +2398,7 @@ void ext4_fc_replay_cleanup(struct super_block *sb)
 	sbi->s_mount_state &= ~EXT4_FC_REPLAY;
 	kfree(sbi->s_fc_replay_state.fc_regions);
 	kfree(sbi->s_fc_replay_state.fc_modified_inodes);
+	memset(&sbi->s_fc_replay_state, 0, sizeof(sbi->s_fc_replay_state));
 }
 
 static bool ext4_fc_value_len_isvalid(struct ext4_sb_info *sbi,
-- 
2.56.0.542.g3ef89b7020-goog