udf: Fix NULL pointer dereference in udf_symlink function

In function udf_symlink, epos.bh is assigned with the value returned by udf_tgetblk. The function udf_tgetblk is defined in udf/misc.c and returns the value of sb_getblk function that could be NULL. Then, epos.bh is used without any check, causing a possible NULL pointer dereference when sb_getblk fails. This fix adds a check to validate the value of epos.bh.

Arturo Giusti committed 5 years ago

Commit fa236c21 parent a1491271 file · +4 −0Browse files

Unified · Split

fs/udf/namei.c+4−0

@@ -934,6 +934,10 @@ static int udf_symlink(struct user_namespace mnt_userns, struct inode dir, · 933 unmodified lines
934	934	iinfo->i_location.partitionReferenceNum,
935	935	0);
936	936	epos.bh = udf_tgetblk(sb, block);
	937	+ if (unlikely(!epos.bh)) {
	938	+ err = -ENOMEM;
	939	+ goto out_no_entry;
	940	+ }
937	941	lock_buffer(epos.bh);
938	942	memset(epos.bh->b_data, 0x00, bsize);
939	943	set_buffer_uptodate(epos.bh);