diff mbox series

udf: fix NULL pointer dereference in udf_rename()

Message ID 20221108022741.492573-1-liushixin2@huawei.com
State New
Headers
Series udf: fix NULL pointer dereference in udf_rename() |

Commit Message

Liu Shixin Nov. 8, 2022, 2:27 a.m. UTC 
  Syzbot reported a NULL pointer dereference:

 Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020
[...]
 Call trace:
  __memset+0x84/0x188 arch/arm64/lib/memset.S:98
  udf_delete_entry fs/udf/namei.c:577 [inline]
  udf_rename+0x47c/0x6d0 fs/udf/namei.c:1173
  vfs_rename+0x59c/0x7f8 fs/namei.c:4756
  do_renameat2+0x490/0x758 fs/namei.c:4907
  __do_sys_renameat2 fs/namei.c:4940 [inline]
[...]

Fix this by check return value of udf_find_entry() since ofi may be NULL
or error code.

Reported-by: syzbot+17fcf98a689ff64f669b@syzkaller.appspotmail.com
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Liu Shixin <liushixin2@huawei.com>
---
 fs/udf/namei.c | 5 +++++
 1 file changed, 5 insertions(+)
diff mbox series

Patch

diff --git a/fs/udf/namei.c b/fs/udf/namei.c
index fb4c30e05245..e0267e72cebb 100644
--- a/fs/udf/namei.c
+++ b/fs/udf/namei.c
@@ -1170,6 +1170,11 @@  static int udf_rename(struct user_namespace *mnt_userns, struct inode *old_dir,
 
 	/* The old fid may have moved - find it again */
 	ofi = udf_find_entry(old_dir, &old_dentry->d_name, &ofibh, &ocfi);
+	if (IS_ERR_OR_NULL(ofi)) {
+		retval = PTR_ERR(ofi);
+		goto end_rename;
+	}
+
 	udf_delete_entry(old_dir, ofi, &ofibh, &ocfi);
 
 	if (new_inode) {