Re: [PATCH] btrfs: fix a NULL pointer dereference during device scan

[Filipe Manana <fdmanana@kernel.org>]

On Thu, Mar 03, 2022 at 08:46:46PM +0800, Anand Jain wrote:
> On 03/03/2022 19:25, fdmanana@kernel.org wrote:
> > From: Filipe Manana <fdmanana@suse.com>
> > 
> > At device_list_add(), we dereference a device's name inside a
> > btrfs_info_in_rcu() that is executed in a branch that can be triggered
> > when the device's name field is NULL, which obviously results in a NULL
> > pointer dereference as rcu_str_deref() tries to access the ->str
> > attribute of a NULL pointer to a struct rcu_string.
> 
> 
> A few lines above check if the device has the bdev, which means the
> device->name can not be null.

Right. I noticed that later and had replied about that before.
Thanks.

> 
> 925 if (device->bdev) {
> 
> Any idea how the test case could able to reach this condition?
> 
> Thanks, Anand
> 
> 
> > Fix that by not dereferencing the name if it's NULL, and instead print
> > the string "<unknown>".
> > 
> > Link: https://lore.kernel.org/linux-btrfs/00000000000066b78e05d94df48b@google.com/
> 
> 
> 
> 
> > Reported-by: syzbot+82650a4e0ed38f218363@syzkaller.appspotmail.com
> > Signed-off-by: Filipe Manana <fdmanana@suse.com>
> > ---
> >   fs/btrfs/volumes.c | 4 +++-
> >   1 file changed, 3 insertions(+), 1 deletion(-)
> > 
> > diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
> > index fa7fee09e39b..f662423fbeb7 100644
> > --- a/fs/btrfs/volumes.c
> > +++ b/fs/btrfs/volumes.c
> > @@ -940,7 +940,9 @@ static noinline struct btrfs_device *device_list_add(const char *path,
> >   			}
> >   			btrfs_info_in_rcu(device->fs_info,
> >   	"devid %llu device path %s changed to %s scanned by %s (%d)",
> > -					  devid, rcu_str_deref(device->name),
> > +					  devid, device->name ?
> > +					  rcu_str_deref(device->name) :
> > +					  "<unknown>",
> >   					  path, current->comm,
> >   					  task_pid_nr(current));
> >   		}
>