From 04fb910da2c857cdf99a331c576c3e5e7197c6dd Mon Sep 17 00:00:00 2001 From: Namjae Jeon Date: Tue, 13 Oct 2026 09:15:00 +0900 Subject: ntfs: fix NULL dereference on index allocation open failure ntfs_index_lookup() returns -ENOENT when ntfs_ia_open() fails to open the index allocation. This error path leaves icx->ib unset, unlike a missing key in an otherwise valid index, which returns an insertion context. ntfs_ie_add() treats -ENOENT as a valid insertion position and dereferences icx->ib when the lookup is not in the index root. A corrupt $I30 bitmap attribute can therefore cause a NULL pointer dereference when adding a directory entry. Return -EIO for index allocation open failures so insertion aborts through the existing error path. Keep -ENOENT for genuinely missing keys and document that other errors leave no valid index entry. Fixes: 0a8ac0c1fa0b ("ntfs: update directory operations") Reported-by: 1sh1ro Signed-off-by: Namjae Jeon --- fs/ntfs/index.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/fs/ntfs/index.c b/fs/ntfs/index.c index 4410df0a8f31..ac22d8407a77 100644 --- a/fs/ntfs/index.c +++ b/fs/ntfs/index.c @@ -812,6 +812,9 @@ static int ntfs_icx_parent_dec(struct ntfs_index_context *icx) * after the search @key, i.e. this is the position in the index at which * an index entry with a key of @key would need to be inserted. * + * If the index cannot be searched, a negative error code other than -ENOENT + * is returned and @icx does not describe a valid index entry. + * * When finished with the entry and its data, call ntfs_index_ctx_put() to free * the context and other associated resources. * @@ -877,7 +880,7 @@ int ntfs_index_lookup(const void *key, const u32 key_len, struct ntfs_index_cont /* Child node present, descend into it. */ icx->ia_ni = ntfs_ia_open(icx, ni); if (!icx->ia_ni) { - err = -ENOENT; + err = -EIO; goto err_out; } -- cgit v1.2.3