fs: ntfs3: Fix possible null-pointer dereferences in mi_read()

[ Upstream commit 97498cd610c0d030a7bd49a7efad974790661162 ]

In a previous commit 2681631c2973 ("fs/ntfs3: Add null pointer check to
attr_load_runs_vcn"), ni can be NULL in attr_load_runs_vcn(), and thus it
should be checked before being used.

However, in the call stack of this commit, mft_ni in mi_read() is
aliased with ni in attr_load_runs_vcn(), and it is also used in
mi_read() at two places:

mi_read()
  rw_lock = &mft_ni->file.run_lock -> No check
  attr_load_runs_vcn(mft_ni, ...)
    ni (namely mft_ni) is checked in the previous commit
  attr_load_runs_vcn(..., &mft_ni->file.run) -> No check

Thus, to avoid possible null-pointer dereferences, the related checks
should be added.

These bugs are reported by a static analysis tool implemented by myself,
and they are found by extending a known bug fixed in the previous commit.
Thus, they could be theoretical bugs.

Signed-off-by: Jia-Ju Bai <baijiaju@buaa.edu.cn>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/fs/ntfs3/record.c b/fs/ntfs3/record.c
index af1e4b3..07037ec 100644 (file)
--- a/fs/ntfs3/record.c
+++ b/fs/ntfs3/record.c
@@ -124,7 +124,7 @@ int mi_read(struct mft_inode *mi, bool is_mft)
        struct rw_semaphore *rw_lock = NULL;
 
        if (is_mounted(sbi)) {
-               if (!is_mft) {
+               if (!is_mft && mft_ni) {
                        rw_lock = &mft_ni->file.run_lock;
                        down_read(rw_lock);
                }
@@ -148,7 +148,7 @@ int mi_read(struct mft_inode *mi, bool is_mft)
                ni_lock(mft_ni);
                down_write(rw_lock);
        }
-       err = attr_load_runs_vcn(mft_ni, ATTR_DATA, NULL, 0, &mft_ni->file.run,
+       err = attr_load_runs_vcn(mft_ni, ATTR_DATA, NULL, 0, run,
                                 vbo >> sbi->cluster_bits);
        if (rw_lock) {
                up_write(rw_lock);