• Ziqi Zhao's avatar
    fs/ntfs3: Fix possible null-pointer dereference in hdr_find_e() · 1f9b94af
    Ziqi Zhao authored
    Upon investigation of the C reproducer provided by Syzbot, it seemed
    the reproducer was trying to mount a corrupted NTFS filesystem, then
    issue a rename syscall to some nodes in the filesystem. This can be
    shown by modifying the reproducer to only include the mount syscall,
    and investigating the filesystem by e.g. `ls` and `rm` commands. As a
    result, during the problematic call to `hdr_fine_e`, the `inode` being
    supplied did not go through `indx_init`, hence the `cmp` function
    pointer was never set.
    
    The fix is simply to check whether `cmp` is not set, and return NULL
    if that's the case, in order to be consistent with other error
    scenarios of the `hdr_find_e` method. The rationale behind this patch
    is that:
    
    - We should prevent crashing the kernel even if the mounted filesystem
      is corrupted. Any syscalls made on the filesystem could return
      invalid, but the kernel should be able to sustain these calls.
    
    - Only very specific corruption would lead to this bug, so it would be
      a pretty rare case in actual usage anyways. Therefore, introducing a
      check to specifically protect against this bug seems appropriate.
      Because of its rarity, an `unlikely` clause is used to wrap around
      this nullity check.
    
    Reported-by: syzbot+60cf892fc31d1f4358fc@syzkaller.appspotmail.com
    Signed-off-by: default avatarZiqi Zhao <astrajoan@yahoo.com>
    Signed-off-by: default avatarKonstantin Komarov <almaz.alexandrovich@paragon-software.com>
    1f9b94af
index.c 56.4 KB