Syzbot reported a NULL pointer dereference:
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020
[...]
Call trace:
__memset+0x84/0x188 arch/arm64/lib/memset.S:98
udf_delete_entry fs/udf/namei.c:577 [inline]
udf_rename+0x47c/0x6d0 fs/udf/namei.c:1173
vfs_rename+0x59c/0x7f8 fs/namei.c:4756
do_renameat2+0x490/0x758 fs/namei.c:4907
__do_sys_renameat2 fs/namei.c:4940 [inline]
[...]
Fix this by check return value of udf_find_entry() since ofi may be NULL
or error code.
Reported-by: [email protected]
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Liu Shixin <[email protected]>
---
fs/udf/namei.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/fs/udf/namei.c b/fs/udf/namei.c
index fb4c30e05245..e0267e72cebb 100644
--- a/fs/udf/namei.c
+++ b/fs/udf/namei.c
@@ -1170,6 +1170,11 @@ static int udf_rename(struct user_namespace *mnt_userns, struct inode *old_dir,
/* The old fid may have moved - find it again */
ofi = udf_find_entry(old_dir, &old_dentry->d_name, &ofibh, &ocfi);
+ if (IS_ERR_OR_NULL(ofi)) {
+ retval = PTR_ERR(ofi);
+ goto end_rename;
+ }
+
udf_delete_entry(old_dir, ofi, &ofibh, &ocfi);
if (new_inode) {
--
2.25.1