* [PATCH] btrfs: fix a NULL pointer dereference during device scan
@ 2022-03-03 11:25 fdmanana
2022-03-03 12:37 ` Filipe Manana
2022-03-03 12:46 ` Anand Jain
0 siblings, 2 replies; 4+ messages in thread
From: fdmanana @ 2022-03-03 11:25 UTC (permalink / raw)
To: linux-btrfs
From: Filipe Manana <fdmanana@suse.com>
At device_list_add(), we dereference a device's name inside a
btrfs_info_in_rcu() that is executed in a branch that can be triggered
when the device's name field is NULL, which obviously results in a NULL
pointer dereference as rcu_str_deref() tries to access the ->str
attribute of a NULL pointer to a struct rcu_string.
Fix that by not dereferencing the name if it's NULL, and instead print
the string "<unknown>".
Link: https://lore.kernel.org/linux-btrfs/00000000000066b78e05d94df48b@google.com/
Reported-by: syzbot+82650a4e0ed38f218363@syzkaller.appspotmail.com
Signed-off-by: Filipe Manana <fdmanana@suse.com>
---
fs/btrfs/volumes.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index fa7fee09e39b..f662423fbeb7 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -940,7 +940,9 @@ static noinline struct btrfs_device *device_list_add(const char *path,
}
btrfs_info_in_rcu(device->fs_info,
"devid %llu device path %s changed to %s scanned by %s (%d)",
- devid, rcu_str_deref(device->name),
+ devid, device->name ?
+ rcu_str_deref(device->name) :
+ "<unknown>",
path, current->comm,
task_pid_nr(current));
}
--
2.33.0
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH] btrfs: fix a NULL pointer dereference during device scan
2022-03-03 11:25 [PATCH] btrfs: fix a NULL pointer dereference during device scan fdmanana
@ 2022-03-03 12:37 ` Filipe Manana
2022-03-03 12:46 ` Anand Jain
1 sibling, 0 replies; 4+ messages in thread
From: Filipe Manana @ 2022-03-03 12:37 UTC (permalink / raw)
To: linux-btrfs
On Thu, Mar 03, 2022 at 11:25:55AM +0000, fdmanana@kernel.org wrote:
> From: Filipe Manana <fdmanana@suse.com>
>
> At device_list_add(), we dereference a device's name inside a
> btrfs_info_in_rcu() that is executed in a branch that can be triggered
> when the device's name field is NULL, which obviously results in a NULL
> pointer dereference as rcu_str_deref() tries to access the ->str
> attribute of a NULL pointer to a struct rcu_string.
>
> Fix that by not dereferencing the name if it's NULL, and instead print
> the string "<unknown>".
>
> Link: https://lore.kernel.org/linux-btrfs/00000000000066b78e05d94df48b@google.com/
> Reported-by: syzbot+82650a4e0ed38f218363@syzkaller.appspotmail.com
> Signed-off-by: Filipe Manana <fdmanana@suse.com>
> ---
> fs/btrfs/volumes.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
> index fa7fee09e39b..f662423fbeb7 100644
> --- a/fs/btrfs/volumes.c
> +++ b/fs/btrfs/volumes.c
> @@ -940,7 +940,9 @@ static noinline struct btrfs_device *device_list_add(const char *path,
> }
> btrfs_info_in_rcu(device->fs_info,
> "devid %llu device path %s changed to %s scanned by %s (%d)",
> - devid, rcu_str_deref(device->name),
> + devid, device->name ?
> + rcu_str_deref(device->name) :
> + "<unknown>",
Taking a better look, device->name shouldn't ever be NULL here because
we have checked device->bdev is set.
So drop this change.
Thanks.
> path, current->comm,
> task_pid_nr(current));
> }
> --
> 2.33.0
>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] btrfs: fix a NULL pointer dereference during device scan
2022-03-03 11:25 [PATCH] btrfs: fix a NULL pointer dereference during device scan fdmanana
2022-03-03 12:37 ` Filipe Manana
@ 2022-03-03 12:46 ` Anand Jain
2022-03-03 13:11 ` Filipe Manana
1 sibling, 1 reply; 4+ messages in thread
From: Anand Jain @ 2022-03-03 12:46 UTC (permalink / raw)
To: fdmanana, linux-btrfs
On 03/03/2022 19:25, fdmanana@kernel.org wrote:
> From: Filipe Manana <fdmanana@suse.com>
>
> At device_list_add(), we dereference a device's name inside a
> btrfs_info_in_rcu() that is executed in a branch that can be triggered
> when the device's name field is NULL, which obviously results in a NULL
> pointer dereference as rcu_str_deref() tries to access the ->str
> attribute of a NULL pointer to a struct rcu_string.
A few lines above check if the device has the bdev, which means the
device->name can not be null.
925 if (device->bdev) {
Any idea how the test case could able to reach this condition?
Thanks, Anand
> Fix that by not dereferencing the name if it's NULL, and instead print
> the string "<unknown>".
>
> Link: https://lore.kernel.org/linux-btrfs/00000000000066b78e05d94df48b@google.com/
> Reported-by: syzbot+82650a4e0ed38f218363@syzkaller.appspotmail.com
> Signed-off-by: Filipe Manana <fdmanana@suse.com>
> ---
> fs/btrfs/volumes.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
> index fa7fee09e39b..f662423fbeb7 100644
> --- a/fs/btrfs/volumes.c
> +++ b/fs/btrfs/volumes.c
> @@ -940,7 +940,9 @@ static noinline struct btrfs_device *device_list_add(const char *path,
> }
> btrfs_info_in_rcu(device->fs_info,
> "devid %llu device path %s changed to %s scanned by %s (%d)",
> - devid, rcu_str_deref(device->name),
> + devid, device->name ?
> + rcu_str_deref(device->name) :
> + "<unknown>",
> path, current->comm,
> task_pid_nr(current));
> }
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH] btrfs: fix a NULL pointer dereference during device scan
2022-03-03 12:46 ` Anand Jain
@ 2022-03-03 13:11 ` Filipe Manana
0 siblings, 0 replies; 4+ messages in thread
From: Filipe Manana @ 2022-03-03 13:11 UTC (permalink / raw)
To: Anand Jain; +Cc: linux-btrfs
On Thu, Mar 03, 2022 at 08:46:46PM +0800, Anand Jain wrote:
> On 03/03/2022 19:25, fdmanana@kernel.org wrote:
> > From: Filipe Manana <fdmanana@suse.com>
> >
> > At device_list_add(), we dereference a device's name inside a
> > btrfs_info_in_rcu() that is executed in a branch that can be triggered
> > when the device's name field is NULL, which obviously results in a NULL
> > pointer dereference as rcu_str_deref() tries to access the ->str
> > attribute of a NULL pointer to a struct rcu_string.
>
>
> A few lines above check if the device has the bdev, which means the
> device->name can not be null.
Right. I noticed that later and had replied about that before.
Thanks.
>
> 925 if (device->bdev) {
>
> Any idea how the test case could able to reach this condition?
>
> Thanks, Anand
>
>
> > Fix that by not dereferencing the name if it's NULL, and instead print
> > the string "<unknown>".
> >
> > Link: https://lore.kernel.org/linux-btrfs/00000000000066b78e05d94df48b@google.com/
>
>
>
>
> > Reported-by: syzbot+82650a4e0ed38f218363@syzkaller.appspotmail.com
> > Signed-off-by: Filipe Manana <fdmanana@suse.com>
> > ---
> > fs/btrfs/volumes.c | 4 +++-
> > 1 file changed, 3 insertions(+), 1 deletion(-)
> >
> > diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
> > index fa7fee09e39b..f662423fbeb7 100644
> > --- a/fs/btrfs/volumes.c
> > +++ b/fs/btrfs/volumes.c
> > @@ -940,7 +940,9 @@ static noinline struct btrfs_device *device_list_add(const char *path,
> > }
> > btrfs_info_in_rcu(device->fs_info,
> > "devid %llu device path %s changed to %s scanned by %s (%d)",
> > - devid, rcu_str_deref(device->name),
> > + devid, device->name ?
> > + rcu_str_deref(device->name) :
> > + "<unknown>",
> > path, current->comm,
> > task_pid_nr(current));
> > }
>
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2022-03-03 13:11 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2022-03-03 11:25 [PATCH] btrfs: fix a NULL pointer dereference during device scan fdmanana
2022-03-03 12:37 ` Filipe Manana
2022-03-03 12:46 ` Anand Jain
2022-03-03 13:11 ` Filipe Manana
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox