ntfs: fix NULL dereference on index allocation open failure

ntfs_index_lookup() returns -ENOENT when ntfs_ia_open() fails to open the
index allocation. This error path leaves icx->ib unset, unlike a missing
key in an otherwise valid index, which returns an insertion context.

ntfs_ie_add() treats -ENOENT as a valid insertion position and dereferences
icx->ib when the lookup is not in the index root. A corrupt $I30 bitmap
attribute can therefore cause a NULL pointer dereference when adding a
directory entry.

Return -EIO for index allocation open failures so insertion aborts through
the existing error path. Keep -ENOENT for genuinely missing keys and
document that other errors leave no valid index entry.

Fixes: 0a8ac0c1fa0b ("ntfs: update directory operations")
Reported-by: 1sh1ro <yangguikun19@qq.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>

1 files changed, 4 insertions, 1 deletions

diff --git a/fs/ntfs/index.c b/fs/ntfs/index.c
index 4410df0a8f31..ac22d8407a77 100644
--- a/fs/ntfs/index.c
+++ b/fs/ntfs/index.c
@@ -812,6 +812,9 @@ static int ntfs_icx_parent_dec(struct ntfs_index_context *icx)
  * after the search @key, i.e. this is the position in the index at which
  * an index entry with a key of @key would need to be inserted.
  *
+ * If the index cannot be searched, a negative error code other than -ENOENT
+ * is returned and @icx does not describe a valid index entry.
+ *
  * When finished with the entry and its data, call ntfs_index_ctx_put() to free
  * the context and other associated resources.
  *
@@ -877,7 +880,7 @@ int ntfs_index_lookup(const void *key, const u32 key_len, struct ntfs_index_cont
 	/* Child node present, descend into it. */
 	icx->ia_ni = ntfs_ia_open(icx, ni);
 	if (!icx->ia_ni) {
-		err = -ENOENT;
+		err = -EIO;
 		goto err_out;
 	}