Re: [Linux-kernel-mentees] [PATCH] hfs, hfsplus: Fix NULL pointer dereference in hfs_find_init()
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: 2020-08-12 07:08:32
Also in:
linux-fsdevel, lkml
On Wed, Aug 12, 2020 at 02:55:56AM -0400, Peilin Ye wrote:
quoted hunk ↗ jump to hunk
Prevent hfs_find_init() from dereferencing `tree` as NULL. Reported-and-tested-by: syzbot+7ca256d0da4af073b2e2@syzkaller.appspotmail.com Signed-off-by: Peilin Ye <redacted> --- fs/hfs/bfind.c | 3 +++ fs/hfsplus/bfind.c | 3 +++ 2 files changed, 6 insertions(+)diff --git a/fs/hfs/bfind.c b/fs/hfs/bfind.c index 4af318fbda77..880b7ea2c0fc 100644 --- a/fs/hfs/bfind.c +++ b/fs/hfs/bfind.c@@ -16,6 +16,9 @@ int hfs_find_init(struct hfs_btree *tree, struct hfs_find_data *fd) { void *ptr; + if (!tree) + return -EINVAL; + fd->tree = tree; fd->bnode = NULL; ptr = kmalloc(tree->max_key_len * 2 + 4, GFP_KERNEL);diff --git a/fs/hfsplus/bfind.c b/fs/hfsplus/bfind.c index ca2ba8c9f82e..85bef3e44d7a 100644 --- a/fs/hfsplus/bfind.c +++ b/fs/hfsplus/bfind.c@@ -16,6 +16,9 @@ int hfs_find_init(struct hfs_btree *tree, struct hfs_find_data *fd) { void *ptr; + if (!tree) + return -EINVAL; +
How can tree ever be NULL in these calls? Shouldn't that be fixed as the root problem here? thanks, greg k-h _______________________________________________ Linux-kernel-mentees mailing list Linux-kernel-mentees@lists.linuxfoundation.org https://lists.linuxfoundation.org/mailman/listinfo/linux-kernel-mentees