Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <808288ae-bf1a-ccc6-ab37-d1b2022b44b5@paragon-software.com>
Date:   Fri, 13 Jan 2023 14:05:56 +0400
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
 Thunderbird/102.6.0
Subject: Re: [PATCH -next] fs/ntfs3: Fix potential NULL/IS_ERR bug in
 ntfs_lookup()
Content-Language: en-US
To:     Peng Zhang <zhangpeng362@huawei.com>, <kari.argillander@gmail.com>,
        <akpm@linux-foundation.org>
CC:     <ntfs3@lists.linux.dev>, <linux-kernel@vger.kernel.org>,
        <sunnanyong@huawei.com>, <wangkefeng.wang@huawei.com>,
        Dan Carpenter <error27@gmail.com>
References: <20230112013248.2464556-1-zhangpeng362@huawei.com>
From:   Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
In-Reply-To: <20230112013248.2464556-1-zhangpeng362@huawei.com>
Content-Type: text/plain; charset="UTF-8"; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk

On 12.01.2023 05:32, Peng Zhang wrote:
> From: ZhangPeng <zhangpeng362@huawei.com>
>
> Dan Carpenter reported a Smatch static checker warning:
>
> fs/ntfs3/namei.c:96 ntfs_lookup()
> error: potential NULL/IS_ERR bug 'inode'
> It will cause null-ptr-deref when dir_search_u() returns NULL if the
> file is not found.
> Fix this by replacing IS_ERR() with IS_ERR_OR_NULL() to add a check for
> NULL.
>
> Fixes: fb6b59b5a2d6 ("fs/ntfs3: Fix null-ptr-deref on inode->i_op in ntfs_lookup()")
> Reported-by: Dan Carpenter <error27@gmail.com>
> Signed-off-by: ZhangPeng <zhangpeng362@huawei.com>
> ---
>   fs/ntfs3/namei.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/fs/ntfs3/namei.c b/fs/ntfs3/namei.c
> index 3db34d5c03dc..f23c2c26dd08 100644
> --- a/fs/ntfs3/namei.c
> +++ b/fs/ntfs3/namei.c
> @@ -93,7 +93,7 @@ static struct dentry *ntfs_lookup(struct inode *dir, struct dentry *dentry,
>   	 * If the MFT record of ntfs inode is not a base record, inode->i_op can be NULL.
>   	 * This causes null pointer dereference in d_splice_alias().
>   	 */
> -	if (!IS_ERR(inode) && inode->i_op == NULL) {
> +	if (!IS_ERR_OR_NULL(inode) && inode->i_op == NULL) {
>   		iput(inode);
>   		inode = ERR_PTR(-EINVAL);
>   	}

Hello.

We have added a patch with this check just before the New Year. (here 
https://lore.kernel.org/lkml/ee705b24-865b-26ff-157d-4cb2a303a962@paragon-software.com/)

Thank you for your attention!