Re: [PATCH] ntfs: fix empty_buf and ra lifetime bugs in ntfs_empty_logfile()

[Namjae Jeon]

On Sun, May 10, 2026 at 11:13 AM DaeMyung Kang <charsyam@xxxxxxxxx> wrote:
>
> ntfs_empty_logfile() has three related allocator bugs around the
> @empty_buf and @ra buffers it uses inside the per-cluster loop.
>
> When the loop encounters a runlist entry with LCN_RL_NOT_MAPPED, the
> function kvfrees @empty_buf and goes to map_vcn to remap.  @empty_buf
> is not cleared.  If ntfs_map_runlist_nolock() fails on re-entry,
> control jumps to the err label which kvfrees @empty_buf a second time.
>
> In the same branch, @ra is left allocated.  When the remap succeeds
> the function falls through the @empty_buf re-allocation and the @ra
> re-allocation, overwriting the previous @ra pointer and leaking it.
>
> The success path frees @empty_buf with kfree() instead of kvfree().
> kvzalloc() may fall back to vmalloc(), in which case kfree() does not
> correctly release the memory.
>
> A KASAN-enabled QEMU harness mirroring this control flow reports
> "BUG: KASAN: double-free" when the second ntfs_map_runlist_nolock()
> fails.
>
> Clear both @empty_buf and @ra after the in-loop releases so the err
> path is a no-op when the buffers have already been freed and so the
> remap-success path does not leak the previous @ra.  Switch the success
> path to kvfree() to match the @empty_buf allocator.
>
> Fixes: 5218cd102aec ("ntfs: update misc operations")
> Signed-off-by: DaeMyung Kang <charsyam@xxxxxxxxx>
Applied it to #ntfs-next.
Thanks!