Re: [PATCH] btrfs: fix a NULL pointer dereference during device scan

[Anand Jain <anand.jain@oracle.com>]

On 03/03/2022 19:25, fdmanana@kernel.org wrote:
> From: Filipe Manana <fdmanana@suse.com>
> 
> At device_list_add(), we dereference a device's name inside a
> btrfs_info_in_rcu() that is executed in a branch that can be triggered
> when the device's name field is NULL, which obviously results in a NULL
> pointer dereference as rcu_str_deref() tries to access the ->str
> attribute of a NULL pointer to a struct rcu_string.


A few lines above check if the device has the bdev, which means the
device->name can not be null.

925 if (device->bdev) {

Any idea how the test case could able to reach this condition?

Thanks, Anand


> Fix that by not dereferencing the name if it's NULL, and instead print
> the string "<unknown>".
> 
> Link: https://lore.kernel.org/linux-btrfs/00000000000066b78e05d94df48b@google.com/




> Reported-by: syzbot+82650a4e0ed38f218363@syzkaller.appspotmail.com
> Signed-off-by: Filipe Manana <fdmanana@suse.com>
> ---
>   fs/btrfs/volumes.c | 4 +++-
>   1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
> index fa7fee09e39b..f662423fbeb7 100644
> --- a/fs/btrfs/volumes.c
> +++ b/fs/btrfs/volumes.c
> @@ -940,7 +940,9 @@ static noinline struct btrfs_device *device_list_add(const char *path,
>   			}
>   			btrfs_info_in_rcu(device->fs_info,
>   	"devid %llu device path %s changed to %s scanned by %s (%d)",
> -					  devid, rcu_str_deref(device->name),
> +					  devid, device->name ?
> +					  rcu_str_deref(device->name) :
> +					  "<unknown>",
>   					  path, current->comm,
>   					  task_pid_nr(current));
>   		}