CVE-2011-2203: Null Pointer Dereference

hfsfindinit() is wrongly assuming that sb->exttree has already been opened and is not NULL but this function can be called when sb->exttree is currently being opened (NULL deref).

Indeed when we have the following call path, the NULL deref. occurs:

In hfsmdbget() we have (at this stage exttree == NULL):

HFSSB(sb)->exttree = hfsbtreeopen(sb, HFSEXTCNID, hfsextkeycmp);

hfsbtreeopen() is calling readmappingpage() which is indirectly a call to hfsreadpage(). Then hfsreadpage() can make the following calls:

hfsreadpage() -> hfsgetblock() -> allocbufferhead() -> hfsextreadextent()

Then hfsextreadextent() calls hfsfindinit() with an exttree == NULL. Then we have a NULL dereference in hfsfindinit().

ptr = kmalloc(tree->maxkeylen (...));

Due to the huge call stack from hfsbtreeopen() to hfsfindinit() there are many ways to fix this dereference but I can't find the proper way to fix it.

Moreover if we look at the code in hfsfindinit().

20 ptr = kmalloc(tree->maxkeylen 2 + 4, GFPKERNEL); 21 if (!ptr) 22 return -ENOMEM; 23 fd->searchkey = ptr; 24 fd->key = ptr + tree->maxkeylen + 2;

We can make "maxkeylen 2 + 4" wrap and have an fd->key pointing outside of the kmalloc()'ed space. Moreover we can make space in fd->searchkey lower than maxkeylen and bad things can occur.

Reference: https://lkml.org/lkml/2011/6/8/154

Acknowledgements:

Red Hat would like to thank Clement Lecigne for reporting this issue.