Linux: ntfs: only count successfully cleared runs when freeing clusters
What fixes it
- 7eb97d8828e7758b9c81277f7802e740a800f78aLinuxCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
In the Linux kernel, the following vulnerability has been resolved:
ntfs: only count successfully cleared runs when freeing clusters
ntfs_cluster_free_from_rl_nolock() adds a run's length to nr_freed whenever the error bookkeeping condition is false, which includes cases where ntfs_bitmap_clear_run() actually failed - e.g. a second run failing with the same errno as an earlier one, or any failure after a non-ENOMEM error was already recorded. Since a failed ntfs_bitmap_clear_run() rolls back its partial modifications, no bits were cleared for that run, yet its length still inflates vol->free_clusters, corrupting statfs output and the allocator's free space gate.
Only count runs whose bitmap clear succeeded.
Text from CVE List
Affected versions 6
- Linuxaffected: 11ccc9107dc460de28af90fac1f42404d9802735 before 7eb97d8828e7758b9c81277f7802e740a800f78aCVE List
- Linuxaffected: 11ccc9107dc460de28af90fac1f42404d9802735 before be9e89ccb8e52a3e4b67feeb03ebd8133091dc7eCVE List
- Linuxaffected: 7.1CVE List
- Linuxunaffected: all versions before 7.1CVE List
- Linuxunaffected: 7.2.7 through 7.2.*CVE List
- Linuxunaffected: 7.3CVE List