Re: [BUG REPORT] ntfs: NULL pointer dereference in ntfs_ie_add() on mkdir() in a crafted image

[Namjae Jeon]

On Mon, Oct 12, 2026 at 5:58 PM 1sh1ro <yangguikun19@xxxxxx> wrote:
>
> Hi Namjae, Hyunchul,
>
> a crafted NTFS image makes the classic NTFS driver (fs/ntfs) dereference a
> NULL pointer when a directory entry is added, which oopses (and panics
> outright on kernels built with panic_on_warn/panic_on_oops, as syzkaller's
> are).  Found by syzbot-style fuzzing of 7.2-rc5; the code is unchanged in
> current mainline (checked against 7.3-rc5 sources).
Can you confirm if an attached patch fixes this issue?
Thanks!
From 9fcb6f763a10b7c29e755a14c9243bdec84f8787 Mon Sep 17 00:00:00 2001
From: Namjae Jeon <linkinjeon@xxxxxxxxxx>
Date: Tue, 13 Oct 2026 09:15:00 +0900
Subject: [PATCH] ntfs: fix NULL dereference on index allocation open failure

ntfs_index_lookup() returns -ENOENT when ntfs_ia_open() fails to open the
index allocation. This error path leaves icx->ib unset, unlike a missing
key in an otherwise valid index, which returns an insertion context.

ntfs_ie_add() treats -ENOENT as a valid insertion position and dereferences
icx->ib when the lookup is not in the index root. A corrupt $I30 bitmap
attribute can therefore cause a NULL pointer dereference when adding a
directory entry.

Return -EIO for index allocation open failures so insertion aborts through
the existing error path. Keep -ENOENT for genuinely missing keys and
document that other errors leave no valid index entry.

Fixes: 0a8ac0c1fa0b ("ntfs: update directory operations")
Reported-by: 1sh1ro <yangguikun19@xxxxxx>
Signed-off-by: Namjae Jeon <linkinjeon@xxxxxxxxxx>
---
 fs/ntfs/index.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/fs/ntfs/index.c b/fs/ntfs/index.c
index 4410df0a8f31..ac22d8407a77 100644
--- a/fs/ntfs/index.c
+++ b/fs/ntfs/index.c
@@ -812,6 +812,9 @@ static int ntfs_icx_parent_dec(struct ntfs_index_context *icx)
  * after the search @key, i.e. this is the position in the index at which
  * an index entry with a key of @key would need to be inserted.
  *
+ * If the index cannot be searched, a negative error code other than -ENOENT
+ * is returned and @icx does not describe a valid index entry.
+ *
  * When finished with the entry and its data, call ntfs_index_ctx_put() to free
  * the context and other associated resources.
  *
@@ -877,7 +880,7 @@ int ntfs_index_lookup(const void *key, const u32 key_len, struct ntfs_index_cont
 	/* Child node present, descend into it. */
 	icx->ia_ni = ntfs_ia_open(icx, ni);
 	if (!icx->ia_ni) {
-		err = -ENOENT;
+		err = -EIO;
 		goto err_out;
 	}
 
-- 
2.34.1