lkml.org 
[lkml]   [2022]   [Nov]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH] udf: fix NULL pointer dereference in udf_rename()
Date
Syzbot reported a NULL pointer dereference:

Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020
[...]
Call trace:
__memset+0x84/0x188 arch/arm64/lib/memset.S:98
udf_delete_entry fs/udf/namei.c:577 [inline]
udf_rename+0x47c/0x6d0 fs/udf/namei.c:1173
vfs_rename+0x59c/0x7f8 fs/namei.c:4756
do_renameat2+0x490/0x758 fs/namei.c:4907
__do_sys_renameat2 fs/namei.c:4940 [inline]
[...]

Fix this by check return value of udf_find_entry() since ofi may be NULL
or error code.

Reported-by: syzbot+17fcf98a689ff64f669b@syzkaller.appspotmail.com
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Liu Shixin <liushixin2@huawei.com>
---
fs/udf/namei.c | 5 +++++
1 file changed, 5 insertions(+)

diff --git a/fs/udf/namei.c b/fs/udf/namei.c
index fb4c30e05245..e0267e72cebb 100644
--- a/fs/udf/namei.c
+++ b/fs/udf/namei.c
@@ -1170,6 +1170,11 @@ static int udf_rename(struct user_namespace *mnt_userns, struct inode *old_dir,

/* The old fid may have moved - find it again */
ofi = udf_find_entry(old_dir, &old_dentry->d_name, &ofibh, &ocfi);
+ if (IS_ERR_OR_NULL(ofi)) {
+ retval = PTR_ERR(ofi);
+ goto end_rename;
+ }
+
udf_delete_entry(old_dir, ofi, &ofibh, &ocfi);

if (new_inode) {
--
2.25.1
\
 
 \ /
  Last update: 2022-11-08 02:40    [W:0.022 / U:0.848 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site