Messages in this thread Patch in this message | | | From | Liu Shixin <> | Subject | [PATCH] udf: fix NULL pointer dereference in udf_rename() | Date | Tue, 8 Nov 2022 10:27:41 +0800 |
| |
Syzbot reported a NULL pointer dereference:
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020 [...] Call trace: __memset+0x84/0x188 arch/arm64/lib/memset.S:98 udf_delete_entry fs/udf/namei.c:577 [inline] udf_rename+0x47c/0x6d0 fs/udf/namei.c:1173 vfs_rename+0x59c/0x7f8 fs/namei.c:4756 do_renameat2+0x490/0x758 fs/namei.c:4907 __do_sys_renameat2 fs/namei.c:4940 [inline] [...]
Fix this by check return value of udf_find_entry() since ofi may be NULL or error code.
Reported-by: syzbot+17fcf98a689ff64f669b@syzkaller.appspotmail.com Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Liu Shixin <liushixin2@huawei.com> --- fs/udf/namei.c | 5 +++++ 1 file changed, 5 insertions(+)
diff --git a/fs/udf/namei.c b/fs/udf/namei.c index fb4c30e05245..e0267e72cebb 100644 --- a/fs/udf/namei.c +++ b/fs/udf/namei.c @@ -1170,6 +1170,11 @@ static int udf_rename(struct user_namespace *mnt_userns, struct inode *old_dir, /* The old fid may have moved - find it again */ ofi = udf_find_entry(old_dir, &old_dentry->d_name, &ofibh, &ocfi); + if (IS_ERR_OR_NULL(ofi)) { + retval = PTR_ERR(ofi); + goto end_rename; + } + udf_delete_entry(old_dir, ofi, &ofibh, &ocfi); if (new_inode) { -- 2.25.1
| |