Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Liu Shixin <liushixin2@huawei.com>
To:     Jan Kara <jack@suse.com>
CC:     <linux-kernel@vger.kernel.org>, Liu Shixin <liushixin2@huawei.com>
Subject: [PATCH] udf: fix NULL pointer dereference in udf_rename()
Date:   Tue, 8 Nov 2022 10:27:41 +0800
Message-ID: <20221108022741.492573-1-liushixin2@huawei.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 7BIT
Content-Type:   text/plain; charset=US-ASCII
Precedence: bulk

Syzbot reported a NULL pointer dereference:

 Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020
[...]
 Call trace:
  __memset+0x84/0x188 arch/arm64/lib/memset.S:98
  udf_delete_entry fs/udf/namei.c:577 [inline]
  udf_rename+0x47c/0x6d0 fs/udf/namei.c:1173
  vfs_rename+0x59c/0x7f8 fs/namei.c:4756
  do_renameat2+0x490/0x758 fs/namei.c:4907
  __do_sys_renameat2 fs/namei.c:4940 [inline]
[...]

Fix this by check return value of udf_find_entry() since ofi may be NULL
or error code.

Reported-by: syzbot+17fcf98a689ff64f669b@syzkaller.appspotmail.com
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Liu Shixin <liushixin2@huawei.com>
---
 fs/udf/namei.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/fs/udf/namei.c b/fs/udf/namei.c
index fb4c30e05245..e0267e72cebb 100644
--- a/fs/udf/namei.c
+++ b/fs/udf/namei.c
@@ -1170,6 +1170,11 @@ static int udf_rename(struct user_namespace *mnt_userns, struct inode *old_dir,
 
 	/* The old fid may have moved - find it again */
 	ofi = udf_find_entry(old_dir, &old_dentry->d_name, &ofibh, &ocfi);
+	if (IS_ERR_OR_NULL(ofi)) {
+		retval = PTR_ERR(ofi);
+		goto end_rename;
+	}
+
 	udf_delete_entry(old_dir, ofi, &ofibh, &ocfi);
 
 	if (new_inode) {
-- 
2.25.1