[PATCH] fs/ntfs3: Fix memory leak of ntfs_fnd on corrupted index root

[laixiangwu]

indx_insert_entry(), indx_delete_entry() and indx_update_dup() allocate
one or two ntfs_fnd structures with fnd_get() before validating the
index root with get_cmp_func(). If the index root describes an unknown
collation rule (which can be the case on a corrupted or maliciously
crafted image), these functions return -EINVAL directly, bypassing the
"out" labels that release the ntfs_fnd allocations.

Since the index type and rule fields are user controlled from the
mounted image, every operation on such an index leaks the ntfs_fnd
memory and can be repeated to exhaust kernel memory.

Release the allocated fnd structures by jumping to the existing error
labels instead of returning directly.

Fixes: 82cae269cfa9 ("fs/ntfs3: Add initialization of super block")
Signed-off-by: laixiangwu <laixiangwu@xxxxxxxxxxxxxxxxxxxx>
---
 fs/ntfs3/index.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c
index 689712d34..9b6f410a5 100644
--- a/fs/ntfs3/index.c
+++ b/fs/ntfs3/index.c
@@ -2049,7 +2049,8 @@ int indx_insert_entry(struct ntfs_index *indx, struct ntfs_inode *ni,
 	cmp = get_cmp_func(root);
 	if (unlikely(!cmp)) {
 		WARN_ON_ONCE(1);
-		return -EINVAL;
+		err = -EINVAL;
+		goto out;
 	}
 
 	if (fnd_is_empty(fnd)) {
@@ -2406,7 +2407,8 @@ int indx_delete_entry(struct ntfs_index *indx, struct ntfs_inode *ni,
 	cmp = get_cmp_func(root);
 	if (unlikely(!cmp)) {
 		WARN_ON_ONCE(1);
-		return -EINVAL;
+		err = -EINVAL;
+		goto out;
 	}
 
 	/* Locate the entry to remove. */
@@ -2787,7 +2789,8 @@ int indx_update_dup(struct ntfs_inode *ni, struct ntfs_sb_info *sbi,
 	cmp = get_cmp_func(root);
 	if (unlikely(!cmp)) {
 		WARN_ON_ONCE(1);
-		return -EINVAL;
+		err = -EINVAL;
+		goto out;
 	}
 
 	/* Find entry in directory. */