Files
ack-tegra/fs
DaeMyung Kang b5198fcdc1 ntfs: fix NULL dereference in ntfs_index_walk_down()
ntfs_index_walk_down() allocates ictx->ib when descending from the root
into an index allocation block. If that allocation fails, the old code
still passes the NULL buffer to ntfs_ib_read(), which can write through
it via ntfs_inode_attr_pread().

Allocate the index block into a temporary pointer and return -ENOMEM
before changing the index context on allocation failure. Also propagate
ERR_PTR() through ntfs_index_next() and ntfs_readdir() so walk-down
allocation or index block read failures are not mistaken for normal
index iteration inside the filesystem.

ntfs_readdir() keeps the existing userspace-visible behavior of
suppressing readdir errors after marking end_in_iterate; this change only
prevents the walk-down failure path from dereferencing NULL internally.

The failure was reproduced with failslab fail-nth injection on getdents64;
the original module hits a NULL pointer dereference in memcpy_orig through
ntfs_ib_read(), while the patched module reaches the same
ntfs_index_walk_down() allocation failure without crashing.

Fixes: 0a8ac0c1fa ("ntfs: update directory operations")
Signed-off-by: DaeMyung Kang <charsyam@gmail.com>
Reviewed-by: Hyunchul Lee <hyc.lee@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
2026-04-27 22:29:04 +09:00
..
2026-01-02 13:43:41 -05:00
2025-11-28 12:42:31 +01:00
2026-04-03 16:53:50 -04:00
2026-04-01 12:26:07 -07:00
…
…
2026-02-19 21:51:00 +09:00
2026-02-19 21:51:00 +09:00
2026-01-12 16:52:09 +01:00
2026-04-14 09:30:15 +02:00
2026-01-12 16:52:09 +01:00
2026-03-23 12:41:58 +01:00
…
…
…
…