[PATCH] ntfs: fix empty_buf and ra lifetime bugs in ntfs_empty_logfile()

[PATCH] ntfs: fix empty_buf and ra lifetime bugs in ntfs_empty_logfile()

[DaeMyung Kang]

ntfs_empty_logfile() has three related allocator bugs around the
@empty_buf and @ra buffers it uses inside the per-cluster loop.

When the loop encounters a runlist entry with LCN_RL_NOT_MAPPED, the
function kvfrees @empty_buf and goes to map_vcn to remap.  @empty_buf
is not cleared.  If ntfs_map_runlist_nolock() fails on re-entry,
control jumps to the err label which kvfrees @empty_buf a second time.

In the same branch, @ra is left allocated.  When the remap succeeds
the function falls through the @empty_buf re-allocation and the @ra
re-allocation, overwriting the previous @ra pointer and leaking it.

The success path frees @empty_buf with kfree() instead of kvfree().
kvzalloc() may fall back to vmalloc(), in which case kfree() does not
correctly release the memory.

A KASAN-enabled QEMU harness mirroring this control flow reports
"BUG: KASAN: double-free" when the second ntfs_map_runlist_nolock()
fails.

Clear both @empty_buf and @ra after the in-loop releases so the err
path is a no-op when the buffers have already been freed and so the
remap-success path does not leak the previous @ra.  Switch the success
path to kvfree() to match the @empty_buf allocator.

Fixes: 5218cd102aec ("ntfs: update misc operations")
Signed-off-by: DaeMyung Kang <charsyam@gmail.com>
---
 fs/ntfs/logfile.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/fs/ntfs/logfile.c b/fs/ntfs/logfile.c
index 2f960b8f8cde..5a09f2b05df5 100644
--- a/fs/ntfs/logfile.c
+++ b/fs/ntfs/logfile.c
@@ -768,6 +768,9 @@ bool ntfs_empty_logfile(struct inode *log_vi)
 		if (unlikely(lcn == LCN_RL_NOT_MAPPED)) {
 			vcn = rl->vcn;
 			kvfree(empty_buf);
+			empty_buf = NULL;
+			kfree(ra);
+			ra = NULL;
 			goto map_vcn;
 		}
 		/* If this run is not valid abort with an error. */
@@ -821,7 +824,7 @@ bool ntfs_empty_logfile(struct inode *log_vi)
 		} while (start < end);
 	} while ((++rl)->vcn < end_vcn);
 	up_write(&log_ni->runlist.lock);
-	kfree(empty_buf);
+	kvfree(empty_buf);
 	kfree(ra);
 	truncate_inode_pages(log_vi->i_mapping, 0);
 	/* Set the flag so we do not have to do it again on remount. */
--
2.34.1

Re: [PATCH] ntfs: fix empty_buf and ra lifetime bugs in ntfs_empty_logfile()

[Namjae Jeon]

On Sun, May 10, 2026 at 11:13 AM DaeMyung Kang <charsyam@gmail.com> wrote:
>
> ntfs_empty_logfile() has three related allocator bugs around the
> @empty_buf and @ra buffers it uses inside the per-cluster loop.
>
> When the loop encounters a runlist entry with LCN_RL_NOT_MAPPED, the
> function kvfrees @empty_buf and goes to map_vcn to remap.  @empty_buf
> is not cleared.  If ntfs_map_runlist_nolock() fails on re-entry,
> control jumps to the err label which kvfrees @empty_buf a second time.
>
> In the same branch, @ra is left allocated.  When the remap succeeds
> the function falls through the @empty_buf re-allocation and the @ra
> re-allocation, overwriting the previous @ra pointer and leaking it.
>
> The success path frees @empty_buf with kfree() instead of kvfree().
> kvzalloc() may fall back to vmalloc(), in which case kfree() does not
> correctly release the memory.
>
> A KASAN-enabled QEMU harness mirroring this control flow reports
> "BUG: KASAN: double-free" when the second ntfs_map_runlist_nolock()
> fails.
>
> Clear both @empty_buf and @ra after the in-loop releases so the err
> path is a no-op when the buffers have already been freed and so the
> remap-success path does not leak the previous @ra.  Switch the success
> path to kvfree() to match the @empty_buf allocator.
>
> Fixes: 5218cd102aec ("ntfs: update misc operations")
> Signed-off-by: DaeMyung Kang <charsyam@gmail.com>
Applied it to #ntfs-next.
Thanks!