linux-kernel - Re: [PATCH -next] fs/ntfs3: Fix potential NULL/IS_ERR bug in ntfs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 13 Jan 2023 14:05:56 +0400
From:   Konstantin Komarov <almaz.alexandrovich@...agon-software.com>
To:     Peng Zhang <zhangpeng362@...wei.com>, <kari.argillander@...il.com>,
        <akpm@...ux-foundation.org>
CC:     <ntfs3@...ts.linux.dev>, <linux-kernel@...r.kernel.org>,
        <sunnanyong@...wei.com>, <wangkefeng.wang@...wei.com>,
        Dan Carpenter <error27@...il.com>
Subject: Re: [PATCH -next] fs/ntfs3: Fix potential NULL/IS_ERR bug in
 ntfs_lookup()

On 12.01.2023 05:32, Peng Zhang wrote:
> From: ZhangPeng <zhangpeng362@...wei.com>
>
> Dan Carpenter reported a Smatch static checker warning:
>
> fs/ntfs3/namei.c:96 ntfs_lookup()
> error: potential NULL/IS_ERR bug 'inode'
> It will cause null-ptr-deref when dir_search_u() returns NULL if the
> file is not found.
> Fix this by replacing IS_ERR() with IS_ERR_OR_NULL() to add a check for
> NULL.
>
> Fixes: fb6b59b5a2d6 ("fs/ntfs3: Fix null-ptr-deref on inode->i_op in ntfs_lookup()")
> Reported-by: Dan Carpenter <error27@...il.com>
> Signed-off-by: ZhangPeng <zhangpeng362@...wei.com>
> ---
>   fs/ntfs3/namei.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/fs/ntfs3/namei.c b/fs/ntfs3/namei.c
> index 3db34d5c03dc..f23c2c26dd08 100644
> --- a/fs/ntfs3/namei.c
> +++ b/fs/ntfs3/namei.c
> @@ -93,7 +93,7 @@ static struct dentry *ntfs_lookup(struct inode *dir, struct dentry *dentry,
>   	 * If the MFT record of ntfs inode is not a base record, inode->i_op can be NULL.
>   	 * This causes null pointer dereference in d_splice_alias().
>   	 */
> -	if (!IS_ERR(inode) && inode->i_op == NULL) {
> +	if (!IS_ERR_OR_NULL(inode) && inode->i_op == NULL) {
>   		iput(inode);
>   		inode = ERR_PTR(-EINVAL);
>   	}

Hello.

We have added a patch with this check just before the New Year. (here 
https://lore.kernel.org/lkml/ee705b24-865b-26ff-157d-4cb2a303a962@paragon-software.com/)

Thank you for your attention!