From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752597AbbDAKzy (ORCPT ); Wed, 1 Apr 2015 06:55:54 -0400 Received: from cantor2.suse.de ([195.135.220.15]:42782 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750848AbbDAKzv (ORCPT ); Wed, 1 Apr 2015 06:55:51 -0400 Date: Wed, 1 Apr 2015 12:55:46 +0200 From: Jan Kara To: Changwoo Min Cc: jack@suse.cz, linux-kernel@vger.kernel.org, taesoo@gatech.edu, changwoo@gatech.edu, sanidhya@gatech.edu, blee@gatech.edu, csong84@gatech.edu Subject: Re: [PATCH] udf: NULL dereference at udf_symlink() on error Message-ID: <20150401105546.GH26339@quack.suse.cz> References: <1427091109-1642-1-git-send-email-changwoo.m@gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1427091109-1642-1-git-send-email-changwoo.m@gmail.com> User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Mon 23-03-15 02:11:49, Changwoo Min wrote: > There is no check for udf_tgetblk(), which could return NULL, in udf_symlink(). > So there is a possibility of returning NULL under heavy memory pressure and > possibility of NULL dereference. > > Signed-off-by: Changwoo Min > --- > fs/udf/namei.c | 4 ++++ > 1 file changed, 4 insertions(+) > > diff --git a/fs/udf/namei.c b/fs/udf/namei.c > index 33b246b..ed2f221 100644 > --- a/fs/udf/namei.c > +++ b/fs/udf/namei.c > @@ -902,6 +902,10 @@ static int udf_symlink(struct inode *dir, struct dentry *dentry, > iinfo->i_location.partitionReferenceNum, > 0); > epos.bh = udf_tgetblk(sb, block); > + if (!epos.bh) { > + err = -ENOMEM; This should be -EIO as per our discussion at the previous patch. Otherwise I agree. Honza > + goto out_no_entry; > + } > lock_buffer(epos.bh); > memset(epos.bh->b_data, 0x00, bsize); > set_buffer_uptodate(epos.bh); > -- > 1.9.1 > -- Jan Kara SUSE Labs, CR