lkml.org 
[lkml]   [2021]   [Jul]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.13 034/266] udf: Fix NULL pointer dereference in udf_symlink function
    Date
    From: Arturo Giusti <koredump@protonmail.com>

    [ Upstream commit fa236c2b2d4436d9f19ee4e5d5924e90ffd7bb43 ]

    In function udf_symlink, epos.bh is assigned with the value returned
    by udf_tgetblk. The function udf_tgetblk is defined in udf/misc.c
    and returns the value of sb_getblk function that could be NULL.
    Then, epos.bh is used without any check, causing a possible
    NULL pointer dereference when sb_getblk fails.

    This fix adds a check to validate the value of epos.bh.

    Link: https://bugzilla.kernel.org/show_bug.cgi?id=213083
    Signed-off-by: Arturo Giusti <koredump@protonmail.com>
    Signed-off-by: Jan Kara <jack@suse.cz>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    fs/udf/namei.c | 4 ++++
    1 file changed, 4 insertions(+)

    diff --git a/fs/udf/namei.c b/fs/udf/namei.c
    index 3ae9f1e91984..7c7c9bbbfa57 100644
    --- a/fs/udf/namei.c
    +++ b/fs/udf/namei.c
    @@ -934,6 +934,10 @@ static int udf_symlink(struct user_namespace *mnt_userns, struct inode *dir,
    iinfo->i_location.partitionReferenceNum,
    0);
    epos.bh = udf_tgetblk(sb, block);
    + if (unlikely(!epos.bh)) {
    + err = -ENOMEM;
    + goto out_no_entry;
    + }
    lock_buffer(epos.bh);
    memset(epos.bh->b_data, 0x00, bsize);
    set_buffer_uptodate(epos.bh);
    --
    2.30.2


    \
     
     \ /
      Last update: 2021-07-15 21:39    [W:4.167 / U:0.032 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site