From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752072AbbCWGaN (ORCPT ); Mon, 23 Mar 2015 02:30:13 -0400 Received: from mail-yh0-f67.google.com ([209.85.213.67]:34517 "EHLO mail-yh0-f67.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751208AbbCWGaK (ORCPT ); Mon, 23 Mar 2015 02:30:10 -0400 From: Changwoo Min To: jack@suse.cz, linux-kernel@vger.kernel.org Cc: taesoo@gatech.edu, changwoo@gatech.edu, sanidhya@gatech.edu, blee@gatech.edu, csong84@gatech.edu, Changwoo Min Subject: [PATCH] udf: NULL dereference at udf_symlink() on error Date: Mon, 23 Mar 2015 02:11:49 -0400 Message-Id: <1427091109-1642-1-git-send-email-changwoo.m@gmail.com> X-Mailer: git-send-email 1.9.1 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org There is no check for udf_tgetblk(), which could return NULL, in udf_symlink(). So there is a possibility of returning NULL under heavy memory pressure and possibility of NULL dereference. Signed-off-by: Changwoo Min --- fs/udf/namei.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/udf/namei.c b/fs/udf/namei.c index 33b246b..ed2f221 100644 --- a/fs/udf/namei.c +++ b/fs/udf/namei.c @@ -902,6 +902,10 @@ static int udf_symlink(struct inode *dir, struct dentry *dentry, iinfo->i_location.partitionReferenceNum, 0); epos.bh = udf_tgetblk(sb, block); + if (!epos.bh) { + err = -ENOMEM; + goto out_no_entry; + } lock_buffer(epos.bh); memset(epos.bh->b_data, 0x00, bsize); set_buffer_uptodate(epos.bh); -- 1.9.1