diff options
| author | Arturo Giusti <koredump@protonmail.com> | 2021-05-18 12:34:57 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2021-07-20 16:15:59 +0200 |
| commit | 3638705ecd5ad2785e996f820121c0ad15ce64b5 (patch) | |
| tree | 41ec559d313977c051a7ff3cfb2fa8961cfec841 /fs | |
| parent | 2fda4ff855d8be14338cc383fad3f2fa2f7d30aa (diff) | |
| download | linux-stable-3638705ecd5ad2785e996f820121c0ad15ce64b5.tar.gz linux-stable-3638705ecd5ad2785e996f820121c0ad15ce64b5.tar.bz2 linux-stable-3638705ecd5ad2785e996f820121c0ad15ce64b5.zip | |
udf: Fix NULL pointer dereference in udf_symlink function
[ Upstream commit fa236c2b2d4436d9f19ee4e5d5924e90ffd7bb43 ]
In function udf_symlink, epos.bh is assigned with the value returned
by udf_tgetblk. The function udf_tgetblk is defined in udf/misc.c
and returns the value of sb_getblk function that could be NULL.
Then, epos.bh is used without any check, causing a possible
NULL pointer dereference when sb_getblk fails.
This fix adds a check to validate the value of epos.bh.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=213083
Signed-off-by: Arturo Giusti <koredump@protonmail.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'fs')
| -rw-r--r-- | fs/udf/namei.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/fs/udf/namei.c b/fs/udf/namei.c index 58cc2414992b..9cfb555db1ad 100644 --- a/fs/udf/namei.c +++ b/fs/udf/namei.c @@ -948,6 +948,10 @@ static int udf_symlink(struct inode *dir, struct dentry *dentry, iinfo->i_location.partitionReferenceNum, 0); epos.bh = udf_tgetblk(sb, block); + if (unlikely(!epos.bh)) { + err = -ENOMEM; + goto out_no_entry; + } lock_buffer(epos.bh); memset(epos.bh->b_data, 0x00, bsize); set_buffer_uptodate(epos.bh); |