[bug report] fs/ntfs3: Fix null-ptr-deref on inode->i_op in ntfs_lookup()

[bug report] fs/ntfs3: Fix null-ptr-deref on inode->i_op in ntfs_lookup()

[Dan Carpenter]

Hello ZhangPeng,

The patch fb6b59b5a2d6: "fs/ntfs3: Fix null-ptr-deref on inode->i_op
in ntfs_lookup()" from Nov 25, 2022, leads to the following Smatch
static checker warning:

	fs/ntfs3/namei.c:96 ntfs_lookup()
	error: potential NULL/IS_ERR bug 'inode'

fs/ntfs3/namei.c
    67 static struct dentry *ntfs_lookup(struct inode *dir, struct dentry *dentry,
    68                                   u32 flags)
    69 {
    70         struct ntfs_inode *ni = ntfs_i(dir);
    71         struct cpu_str *uni = __getname();
    72         struct inode *inode;
    73         int err;
    74 
    75         if (!uni)
    76                 inode = ERR_PTR(-ENOMEM);
    77         else {
    78                 err = ntfs_nls_to_utf16(ni->mi.sbi, dentry->d_name.name,
    79                                         dentry->d_name.len, uni, NTFS_NAME_LEN,
    80                                         UTF16_HOST_ENDIAN);
    81                 if (err < 0)
    82                         inode = ERR_PTR(err);
    83                 else {
    84                         ni_lock(ni);
    85                         inode = dir_search_u(dir, uni, NULL);

The issue for Smatch is that dir_search_u() returns NULL if the file
is not found, or an error if there is an error, or a valid pointer.

    86                         ni_unlock(ni);
    87                 }
    88                 __putname(uni);
    89         }
    90 
    91         /*
    92          * Check for a null pointer
    93          * If the MFT record of ntfs inode is not a base record, inode->i_op can be NULL.
    94          * This causes null pointer dereference in d_splice_alias().
    95          */
--> 96         if (!IS_ERR(inode) && inode->i_op == NULL) {
                                     ^^^^^^^
Potential NULL dereference.  Seems easy to hit too.

    97                 iput(inode);
    98                 inode = ERR_PTR(-EINVAL);
    99         }
    100 
    101         return d_splice_alias(inode, dentry);
    102 }

regards,
dan carpenter