From nobody Tue Sep 16 01:14:49 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CEC7EC54EBC for ; Sat, 7 Jan 2023 19:50:56 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232708AbjAGTuz (ORCPT ); Sat, 7 Jan 2023 14:50:55 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49858 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232480AbjAGTus (ORCPT ); Sat, 7 Jan 2023 14:50:48 -0500 Received: from mail.ispras.ru (mail.ispras.ru [83.149.199.84]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 21281482AF for ; Sat, 7 Jan 2023 11:50:48 -0800 (PST) Received: from fedcomp.intra.ispras.ru (unknown [46.242.14.200]) by mail.ispras.ru (Postfix) with ESMTPSA id 8EE95419E9CE; Sat, 7 Jan 2023 19:50:46 +0000 (UTC) DKIM-Filter: OpenDKIM Filter v2.11.0 mail.ispras.ru 8EE95419E9CE DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ispras.ru; s=default; t=1673121046; bh=46Om3KozLAr4Twn7WH/XwL5S4olDBoQ+x1OHtQBj8fI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=nRW2dSWV2eWVdP0jogGl0ihZC4AGM9yxvUG0fCqtSamboh0hoilQ6jjhxEYJMryxV YaEpRcsBm9L/gCSrq7TgLUEUWaYAQ/ZSGJFea2xnLqmSlWh0rKdNh4mQ4yVivK2lVV ZKLUR64NIHEL9M8QpdIBNAaK6L5YoDyVuXvF+MKI= From: Fedor Pchelkin To: Jan Kara Cc: Fedor Pchelkin , linux-kernel@vger.kernel.org, Alexey Khoroshilov , lvc-project@linuxtesting.org, syzbot+8a5a459f324d510ea15a@syzkaller.appspotmail.com Subject: [PATCH 1/1] udf: Fix null-ptr-deref in udf_write_fi() Date: Sat, 7 Jan 2023 22:50:16 +0300 Message-Id: <20230107195016.290627-2-pchelkin@ispras.ru> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20230107195016.290627-1-pchelkin@ispras.ru> References: <20230107195016.290627-1-pchelkin@ispras.ru> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" udf_find_entry() can return NULL or an error pointer if it fails. So we should check its return value to avoid NULL pointer dereferencing in udf_write_fi() (which is called from udf_delete_entry()). Also, if udf_find_entry() returns an error pointer, it is possible that ofibh and ocfi structs hold invalid values which can cause additional problems in udf_write_fi(). If udf_find_entry() returns an error pointer, udf_rename() should return with an error code. If udf_find_entry() returns NULL, ofi has probably already been deleted. Found by Linux Verification Center (linuxtesting.org) with Syzkaller. Fixes: 231473f6ddce ("udf: Return error from udf_find_entry()") Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot+8a5a459f324d510ea15a@syzkaller.appspotmail.com Signed-off-by: Fedor Pchelkin Signed-off-by: Alexey Khoroshilov --- fs/udf/namei.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/fs/udf/namei.c b/fs/udf/namei.c index 7c95c549dd64..6b058c6ebf93 100644 --- a/fs/udf/namei.c +++ b/fs/udf/namei.c @@ -1170,7 +1170,12 @@ static int udf_rename(struct user_namespace *mnt_use= rns, struct inode *old_dir, =20 /* The old fid may have moved - find it again */ ofi =3D udf_find_entry(old_dir, &old_dentry->d_name, &ofibh, &ocfi); - udf_delete_entry(old_dir, ofi, &ofibh, &ocfi); + if (ofi && IS_ERR(ofi)) { + retval =3D PTR_ERR(ofi); + goto end_rename; + } else if (ofi) { + udf_delete_entry(old_dir, ofi, &ofibh, &ocfi); + } =20 if (new_inode) { new_inode->i_ctime =3D current_time(new_inode); --=20 2.34.1