CVE: CVE-2023-54196
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: Fix NULL pointer dereference in 'ni_write_inode'

Syzbot found the following issue:
Unable to handle kernel NULL pointer dereference at virtual address [PII_REDACTED]
Mem abort info:
  ESR = 0x[PII_REDACTED]000006
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x06: level 2 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000006
  CM = 0, WnR = 0
user pgtable: 4k pages, 48-bit VAs, pgdp=000000010af56000
[[PII_REDACTED]] pgd=[PII_REDACTED]0da003, p4d=[PII_REDACTED]0da003, pud=[PII_REDACTED]0ce003, pmd=[PII_REDACTED]
Internal error: Oops: [PII_REDACTED] [#1] PREEMPT SMP
Modules linked in:
CPU: 1 PID: 3036 Comm: syz-executor206 Not tainted 6.0.0-rc6-syzkaller-17739-g16c9f284e746 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : is_rec_inuse fs/ntfs3/ntfs.h:313 [inline]
pc : ni_write_inode+0xac/0x798 fs/ntfs3/frecord.c:3232
lr : ni_write_inode+0xa0/0x798 fs/ntfs3/frecord.c:3226
sp : ffff8000126c3800
x29: ffff8000126c3860 x28: [PII_REDACTED] x27: ffff0000c8b02000
x26: ffff0000c7502320 x25: ffff0000c7502288 x24: [PII_REDACTED]
x23: ffff80000cbec91c x22: ffff0000c8b03000 x21: ffff0000c8b02000
x20: [PII_REDACTED] x19: ffff0000c75024d8 x18:[PII_REDACTED]0000c0
x17: ffff80000dd1b198 x16: ffff80000db59158 x15: ffff0000c4b6b500
x14:[PII_REDACTED]0000b8 x13: [PII_REDACTED] x12: ffff0000c4b6b500
x11: ff80800008be1b60 x10: [PII_REDACTED] x9 : ffff0000c4b6b500
x8 : [PII_REDACTED] x7 : ffff800008be1b50 x6 : [PII_REDACTED]
x5 : [PII_REDACTED] x4 : [PII_REDACTED] x3 : [PII_REDACTED]
x2 : [PII_REDACTED] x1 : [PII_REDACTED] x0 : [PII_REDACTED]
Call trace:
 is_rec_inuse fs/ntfs3/ntfs.h:313 [inline]
 ni_write_inode+0xac/0x798 fs/ntfs3/frecord.c:3232
 ntfs_evict_inode+0x54/0x84 fs/ntfs3/inode.c:1744
 evict+0xec/0x334 fs/inode.c:665
 iput_final fs/inode.c:1748 [inline]
 iput+0x2c4/0x324 fs/inode.c:1774
 ntfs_new_inode+0x7c/0xe0 fs/ntfs3/fsntfs.c:1660
 ntfs_create_inode+0x20c/0xe78 fs/ntfs3/inode.c:1278
 ntfs_create+0x54/0x74 fs/ntfs3/namei.c:100
 lookup_open fs/namei.c:3413 [inline]
 open_last_lookups fs/namei.c:3481 [inline]
 path_openat+0x804/0x11c4 fs/namei.c:3688
 do_filp_open+0xdc/0x1b8 fs/namei.c:3718
 do_sys_openat2+0xb8/0x22c fs/open.c:1311
 do_sys_open fs/open.c:1327 [inline]
 __do_sys_openat fs/open.c:1343 [inline]
 __se_sys_openat fs/open.c:1338 [inline]
 __arm64_sys_openat+0xb0/0xe0 fs/open.c:1338
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall arch/arm64/kernel/syscall.c:52 [inline]
 el0_svc_common+0x138/0x220 arch/arm64/kernel/syscall.c:142
 do_el0_svc+0x48/0x164 arch/arm64/kernel/syscall.c:206
 el0_svc+0x58/0x150 arch/arm64/kernel/entry-common.c:636
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:654
 el0t_64_sync+0x18c/0x190
Code: 97dafee4 340001b4 f9401328 2a1f03e0 (79402d14)
---[ end trace [PII_REDACTED] ]---

Above issue may happens as follows:
ntfs_new_inode
  mi_init
    mi->mrec = kmalloc(sbi->record_size, GFP_NOFS); -->failed to allocate memory
      if (!mi->mrec)
        return -ENOMEM;
iput
  iput_final
    evict
      ntfs_evict_inode
        ni_write_inode
	  is_rec_inuse(ni->mi.mrec)-> As 'ni->mi.mrec' is NULL trigger NULL-ptr-deref

To solve above issue if new inode failed make inode bad before call 'iput()' in
'ntfs_new_inode()'.
References: https://git.kernel.org/stable/c/1c5cffe0d662fb2de7b63176c2582abb69b5f538; https://git.kernel.org/stable/c/329fc4d3f73d865b25f2ee4eafafb040ace37ad5; https://git.kernel.org/stable/c/6d3d3283e6b4fb3f3ee05dac30ee1461930b8103