Re: [PATCH] btrfs: fix a NULL pointer dereference during device scan

[Filipe Manana <fdmanana@kernel.org>]

On Thu, Mar 03, 2022 at 11:25:55AM +0000, fdmanana@kernel.org wrote:
> From: Filipe Manana <fdmanana@suse.com>
> 
> At device_list_add(), we dereference a device's name inside a
> btrfs_info_in_rcu() that is executed in a branch that can be triggered
> when the device's name field is NULL, which obviously results in a NULL
> pointer dereference as rcu_str_deref() tries to access the ->str
> attribute of a NULL pointer to a struct rcu_string.
> 
> Fix that by not dereferencing the name if it's NULL, and instead print
> the string "<unknown>".
> 
> Link: https://lore.kernel.org/linux-btrfs/00000000000066b78e05d94df48b@google.com/
> Reported-by: syzbot+82650a4e0ed38f218363@syzkaller.appspotmail.com
> Signed-off-by: Filipe Manana <fdmanana@suse.com>
> ---
>  fs/btrfs/volumes.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
> index fa7fee09e39b..f662423fbeb7 100644
> --- a/fs/btrfs/volumes.c
> +++ b/fs/btrfs/volumes.c
> @@ -940,7 +940,9 @@ static noinline struct btrfs_device *device_list_add(const char *path,
>  			}
>  			btrfs_info_in_rcu(device->fs_info,
>  	"devid %llu device path %s changed to %s scanned by %s (%d)",
> -					  devid, rcu_str_deref(device->name),
> +					  devid, device->name ?
> +					  rcu_str_deref(device->name) :
> +					  "<unknown>",

Taking a better look, device->name shouldn't ever be NULL here because
we have checked device->bdev is set.

So drop this change.

Thanks.

>  					  path, current->comm,
>  					  task_pid_nr(current));
>  		}
> -- 
> 2.33.0
>