From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E7742C00528 for ; Mon, 24 Jul 2023 01:45:41 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232547AbjGXBpk (ORCPT ); Sun, 23 Jul 2023 21:45:40 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48376 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232645AbjGXBng (ORCPT ); Sun, 23 Jul 2023 21:43:36 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1F1563A8E; Sun, 23 Jul 2023 18:38:20 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id BD7B961011; Mon, 24 Jul 2023 01:33:53 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A18C2C43391; Mon, 24 Jul 2023 01:33:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1690162433; bh=KMhQetU806dk4icQ2tNk52KZXhLwLfb93+upewimOyk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ZPYCe5ZwkRR4m+M9dPX0Msbg1WiWqbHnrQ7gQSMVyUbRfU4SfMzztdgb72OXBIKXd Jr7l3XKeBl2bmJVzZW1zJpbNqWl8h4lHp8gJDdrQfGECcDuiTKQUCY1J8L5z3YQluX 6ycref9BYXpfR5MjfJTs1aNmU4Bfuq2JB+0kP6okTf50nZyP6hQs+GiMT6HIdGSxir L5546gPNyOGOgBLzNfCcVG9GYq0KqZ/RRKsI04alpe9SgXxWJi1+oLJpU9U0sjvyGi 3cSLgvWZq+qpEqDSpUqLBI434QksPoomgrmn/1SFrdGfOG9pOhxCR58/8ItLG/g4Mf e2vbtWInxxO6A== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Jia-Ju Bai , Konstantin Komarov , Sasha Levin Subject: [PATCH AUTOSEL 5.15 19/24] fs: ntfs3: Fix possible null-pointer dereferences in mi_read() Date: Sun, 23 Jul 2023 21:33:20 -0400 Message-Id: <20230724013325.2332084-19-sashal@kernel.org> X-Mailer: git-send-email 2.39.2 In-Reply-To: <20230724013325.2332084-1-sashal@kernel.org> References: <20230724013325.2332084-1-sashal@kernel.org> MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore X-stable-base: Linux 5.15.121 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Jia-Ju Bai [ Upstream commit 97498cd610c0d030a7bd49a7efad974790661162 ] In a previous commit 2681631c2973 ("fs/ntfs3: Add null pointer check to attr_load_runs_vcn"), ni can be NULL in attr_load_runs_vcn(), and thus it should be checked before being used. However, in the call stack of this commit, mft_ni in mi_read() is aliased with ni in attr_load_runs_vcn(), and it is also used in mi_read() at two places: mi_read() rw_lock = &mft_ni->file.run_lock -> No check attr_load_runs_vcn(mft_ni, ...) ni (namely mft_ni) is checked in the previous commit attr_load_runs_vcn(..., &mft_ni->file.run) -> No check Thus, to avoid possible null-pointer dereferences, the related checks should be added. These bugs are reported by a static analysis tool implemented by myself, and they are found by extending a known bug fixed in the previous commit. Thus, they could be theoretical bugs. Signed-off-by: Jia-Ju Bai Signed-off-by: Konstantin Komarov Signed-off-by: Sasha Levin --- fs/ntfs3/record.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/ntfs3/record.c b/fs/ntfs3/record.c index 41f6e578966b2..3d222b1c8f038 100644 --- a/fs/ntfs3/record.c +++ b/fs/ntfs3/record.c @@ -124,7 +124,7 @@ int mi_read(struct mft_inode *mi, bool is_mft) struct rw_semaphore *rw_lock = NULL; if (is_mounted(sbi)) { - if (!is_mft) { + if (!is_mft && mft_ni) { rw_lock = &mft_ni->file.run_lock; down_read(rw_lock); } @@ -148,7 +148,7 @@ int mi_read(struct mft_inode *mi, bool is_mft) ni_lock(mft_ni); down_write(rw_lock); } - err = attr_load_runs_vcn(mft_ni, ATTR_DATA, NULL, 0, &mft_ni->file.run, + err = attr_load_runs_vcn(mft_ni, ATTR_DATA, NULL, 0, run, vbo >> sbi->cluster_bits); if (rw_lock) { up_write(rw_lock); -- 2.39.2