linux-kernel - Re: [PATCH 2/3] fs/ntfs3: Potential NULL dereference in hdr_find

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 24 Aug 2021 12:35:15 +0300
From:   Kari Argillander <kari.argillander@...il.com>
To:     Dan Carpenter <dan.carpenter@...cle.com>
Cc:     Konstantin Komarov <almaz.alexandrovich@...agon-software.com>,
        ntfs3@...ts.linux.dev, linux-kernel@...r.kernel.org,
        kernel-janitors@...r.kernel.org
Subject: Re: [PATCH 2/3] fs/ntfs3: Potential NULL dereference in
 hdr_find_split()

On Tue, Aug 24, 2021 at 10:50:15AM +0300, Dan Carpenter wrote:
> The "e" pointer is dereferenced before it has been checked for NULL.
> Move the dereference after the NULL check to prevent an Oops.
> 
> Fixes: 82cae269cfa9 ("fs/ntfs3: Add initialization of super block")
> Signed-off-by: Dan Carpenter <dan.carpenter@...cle.com>

Reviewed-by: Kari Argillander <kari.argillander@...il.com>

> ---
>  fs/ntfs3/index.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c
> index 07d6dee0a4ba..489e0fffbc75 100644
> --- a/fs/ntfs3/index.c
> +++ b/fs/ntfs3/index.c
> @@ -556,11 +556,12 @@ static const struct NTFS_DE *hdr_find_split(const struct INDEX_HDR *hdr)
>  	size_t o;
>  	const struct NTFS_DE *e = hdr_first_de(hdr);
>  	u32 used_2 = le32_to_cpu(hdr->used) >> 1;
> -	u16 esize = le16_to_cpu(e->size);
> +	u16 esize;
>  
>  	if (!e || de_is_last(e))
>  		return NULL;
>  
> +	esize = le16_to_cpu(e->size);
>  	for (o = le32_to_cpu(hdr->de_off) + esize; o < used_2; o += esize) {
>  		const struct NTFS_DE *p = e;