In function udf_symlink, epos.bh is assigned with the value returned by udf_tgetblk. The function udf_tgetblk is defined in udf/misc.c and returns the value of sb_getblk function that could be NULL. Then, epos.bh is used without any check, causing a possible NULL pointer dereference when sb_getblk fails. This fix adds a check to validate the value of epos.bh.
Unified · Split
| @@ -934,6 +934,10 @@ static int udf_symlink(struct user_namespace *mnt_userns, struct inode *dir, · 933 unmodified lines | |||
| 934 | iinfo->i_location.partitionReferenceNum, | 934 | iinfo->i_location.partitionReferenceNum, |
| 935 | 0); | 935 | 0); |
| 936 | epos.bh = udf_tgetblk(sb, block); | 936 | epos.bh = udf_tgetblk(sb, block); |
| 937 | if (unlikely(!epos.bh)) { | ||
| 938 | err = -ENOMEM; | ||
| 939 | goto out_no_entry; | ||
| 940 | } | ||
| 937 | lock_buffer(epos.bh); | 941 | lock_buffer(epos.bh); |
| 938 | memset(epos.bh->b_data, 0x00, bsize); | 942 | memset(epos.bh->b_data, 0x00, bsize); |
| 939 | set_buffer_uptodate(epos.bh); | 943 | set_buffer_uptodate(epos.bh); |