From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 99DBCC001B0 for ; Mon, 24 Jul 2023 01:39:15 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231926AbjGXBjO (ORCPT ); Sun, 23 Jul 2023 21:39:14 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41394 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229978AbjGXBiV (ORCPT ); Sun, 23 Jul 2023 21:38:21 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 49A444C15; Sun, 23 Jul 2023 18:34:27 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 5CD0E60FBC; Mon, 24 Jul 2023 01:32:21 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 43A11C433C8; Mon, 24 Jul 2023 01:32:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1690162340; bh=eY/O38TIuagmxVVIvA3LPSw0LpehIlJSyyTA6jFqumk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=hX7lOpS8AocsmWeGwyOtoskE+HyJ5WWD+hNDWlefYFTBELyFry6LOdXcdT19mP9Q9 kfPPEbdBpPCT0D2fYL3KOB6N5YKeUf8521fVWot/bqXU5eJfAF2HZRqo95/Gg1TLGB iOqSpJgeTTZQmDxQMa7WNfk/7KOb/cJLK1mdWCj8LzVpvG3emupzDq8ydRKSvF8KrE 9gb17vACv813+Gg903QQky1dn2O0boOSPDnbVAD2IEpl7NqpMemYbnnybeZKVDPfKk IMENn7tTjnvsmG8g/G2bcM6Qn3YrsqJWL+hQupTiKPF17bo2MwVd+zi5R+CljyZtlb m4kpKHKAOa1QA== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Jia-Ju Bai , Konstantin Komarov , Sasha Levin Subject: [PATCH AUTOSEL 6.4 29/40] fs: ntfs3: Fix possible null-pointer dereferences in mi_read() Date: Sun, 23 Jul 2023 21:31:29 -0400 Message-Id: <20230724013140.2327815-29-sashal@kernel.org> X-Mailer: git-send-email 2.39.2 In-Reply-To: <20230724013140.2327815-1-sashal@kernel.org> References: <20230724013140.2327815-1-sashal@kernel.org> MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore X-stable-base: Linux 6.4.5 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Jia-Ju Bai [ Upstream commit 97498cd610c0d030a7bd49a7efad974790661162 ] In a previous commit 2681631c2973 ("fs/ntfs3: Add null pointer check to attr_load_runs_vcn"), ni can be NULL in attr_load_runs_vcn(), and thus it should be checked before being used. However, in the call stack of this commit, mft_ni in mi_read() is aliased with ni in attr_load_runs_vcn(), and it is also used in mi_read() at two places: mi_read() rw_lock = &mft_ni->file.run_lock -> No check attr_load_runs_vcn(mft_ni, ...) ni (namely mft_ni) is checked in the previous commit attr_load_runs_vcn(..., &mft_ni->file.run) -> No check Thus, to avoid possible null-pointer dereferences, the related checks should be added. These bugs are reported by a static analysis tool implemented by myself, and they are found by extending a known bug fixed in the previous commit. Thus, they could be theoretical bugs. Signed-off-by: Jia-Ju Bai Signed-off-by: Konstantin Komarov Signed-off-by: Sasha Levin --- fs/ntfs3/record.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/ntfs3/record.c b/fs/ntfs3/record.c index 2a281cead2bcc..7060f784c2d72 100644 --- a/fs/ntfs3/record.c +++ b/fs/ntfs3/record.c @@ -124,7 +124,7 @@ int mi_read(struct mft_inode *mi, bool is_mft) struct rw_semaphore *rw_lock = NULL; if (is_mounted(sbi)) { - if (!is_mft) { + if (!is_mft && mft_ni) { rw_lock = &mft_ni->file.run_lock; down_read(rw_lock); } @@ -148,7 +148,7 @@ int mi_read(struct mft_inode *mi, bool is_mft) ni_lock(mft_ni); down_write(rw_lock); } - err = attr_load_runs_vcn(mft_ni, ATTR_DATA, NULL, 0, &mft_ni->file.run, + err = attr_load_runs_vcn(mft_ni, ATTR_DATA, NULL, 0, run, vbo >> sbi->cluster_bits); if (rw_lock) { up_write(rw_lock); -- 2.39.2