Re: [BUG REPORT] ntfs: NULL pointer dereference in ntfs_ie_add() on mkdir() in a crafted image

[1sh1ro]

Hi Namjae,

Confirmed -- the patch fixes it. I applied it to a 7.2-rc5 build and re-ran the
reproducer (mount the crafted 2 MB image, then mkdir).

Unpatched (7.2-rc5, and identical on current 7.3-rc5):

  ntfs: (device loop0): ntfs_ia_open(): Failed to open index allocation of inode 5
  Oops: general protection fault ... KASAN: null-ptr-deref in range [0x20-0x27]
  RIP: 0010:ntfs_ie_add+0x40d/0x9b0
  Call Trace: ntfs_index_add_filename -> __ntfs_create -> ntfs_mkdir

With your patch (7.2-rc5 + patch):

  ntfs: (device loop0): ntfs_ia_open(): Failed to open index allocation of inode 5
  ntfs: (device loop0): ntfs_ie_add(): Failed to find place for new entry
  mkdir: cannot create directory '/mnt/t/probe': Input/output error

No oops and no KASAN report -- mkdir() now aborts cleanly through the -EIO path,
which is exactly what the -ENOENT -> -EIO change in ntfs_index_lookup() should
do. The same crash still reproduces on 7.3-rc5, so the fix is still needed
upstream.

Thanks,
1sh1ro