linux-kernel - [PATCH] udf: fix NULL pointer dereference in udf

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20221108022741.492573-1-liushixin2@huawei.com>
Date:   Tue, 8 Nov 2022 10:27:41 +0800
From:   Liu Shixin <liushixin2@...wei.com>
To:     Jan Kara <jack@...e.com>
CC:     <linux-kernel@...r.kernel.org>, Liu Shixin <liushixin2@...wei.com>
Subject: [PATCH] udf: fix NULL pointer dereference in udf_rename()

Syzbot reported a NULL pointer dereference:

 Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020
[...]
 Call trace:
  __memset+0x84/0x188 arch/arm64/lib/memset.S:98
  udf_delete_entry fs/udf/namei.c:577 [inline]
  udf_rename+0x47c/0x6d0 fs/udf/namei.c:1173
  vfs_rename+0x59c/0x7f8 fs/namei.c:4756
  do_renameat2+0x490/0x758 fs/namei.c:4907
  __do_sys_renameat2 fs/namei.c:4940 [inline]
[...]

Fix this by check return value of udf_find_entry() since ofi may be NULL
or error code.

Reported-by: syzbot+17fcf98a689ff64f669b@...kaller.appspotmail.com
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Liu Shixin <liushixin2@...wei.com>
---
 fs/udf/namei.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/fs/udf/namei.c b/fs/udf/namei.c
index fb4c30e05245..e0267e72cebb 100644
--- a/fs/udf/namei.c
+++ b/fs/udf/namei.c
@@ -1170,6 +1170,11 @@ static int udf_rename(struct user_namespace *mnt_userns, struct inode *old_dir,
 
 	/* The old fid may have moved - find it again */
 	ofi = udf_find_entry(old_dir, &old_dentry->d_name, &ofibh, &ocfi);
+	if (IS_ERR_OR_NULL(ofi)) {
+		retval = PTR_ERR(ofi);
+		goto end_rename;
+	}
+
 	udf_delete_entry(old_dir, ofi, &ofibh, &ocfi);
 
 	if (new_inode) {
-- 
2.25.1