New: null pointer dereference in xfs_dir_isempty()

https://bugzilla.kernel.org/show_bug.cgi?id=200925

Bug ID: 200925
Summary: null pointer dereference in xfs_dir_isempty()
Product: File System
Version: 2.5
Kernel Version: 4.18
Hardware: All
OS: Linux
Tree: Mainline
Status: NEW
Severity: normal
Priority: P1
Component: XFS
Assignee: [email protected]
Reporter: [email protected]
Regression: No

Created attachment 278069
--> https://bugzilla.kernel.org/attachment.cgi?id=278069&action=edit
poc.c

- Reproduce

# mkdir mnt
# mount -t xfs 79.img mnt
# gcc 79.c
# ./a.out ./mnt

- Kernel message
Check attachment: 79.log

- Reason
https://elixir.bootlin.com/linux/latest/source/fs/xfs/libxfs/xfs_dir2.c#L185

        sfp = (xfs_dir2_sf_hdr_t *)dp->i_df.if_u1.if_data;
        return !sfp->count;

Missing checks on sfp.

Reported by Wen Xu ([email protected]) from SSLab.

You are receiving this mail because:
You are watching the assignee of the bug.

https://bugzilla.kernel.org/show_bug.cgi?id=200925

--- Comment #1 from Wen Xu ([email protected]) ---
Created attachment 278071
--> https://bugzilla.kernel.org/attachment.cgi?id=278071&action=edit
The (compressed) crafted image which causes crash

You are receiving this mail because:
You are watching the assignee of the bug.

https://bugzilla.kernel.org/show_bug.cgi?id=200925

--- Comment #2 from Wen Xu ([email protected]) ---
Created attachment 278073
--> https://bugzilla.kernel.org/attachment.cgi?id=278073&action=edit
kernel log

You are receiving this mail because:
You are watching the assignee of the bug.