[BUG] afs: ERR_PTR dereference in afs_lookup_server() error path

[BUG] afs: ERR_PTR dereference in afs_lookup_server() error path

[Farhad Alemi]

Hello David and Marc,

While fuzzing Linux 7.1-rc5 with syzkaller, as part of research at ASU's
SEFCOM lab, we hit the crash below. Crash reports can be found here:

  https://github.com/farhad-alemi/public_bug_reports/tree/main/104-afs-err_ptr-deref-afs_put_addrlist/

  BUG: unable to handle page fault for address: ffffffffffffff9f
  RIP: 0010:afs_put_addrlist+0x43/0x250 fs/afs/addr_list.c:38
  afs_lookup_server+0xd3f/0x1020 fs/afs/server.c:243
  afs_alloc_server_list+0x800/0x11a0 fs/afs/server_list.c:82
  afs_create_volume+0x995/0x1290 fs/afs/volume.c:227
  afs_get_tree+0x955/0x10b0 fs/afs/super.c:555

Our reproducer.c is available upon request.

Happy to test a patch if that would help.

Regards,

Re: [BUG] afs: ERR_PTR dereference in afs_lookup_server() error path

[David Howells]

Hi Farhad,

> While fuzzing Linux 7.1-rc5 with syzkaller, as part of research at ASU's
> SEFCOM lab, we hit the crash below. Crash reports can be found here:

Have you tried it with 7.3-rc1?

>   BUG: unable to handle page fault for address: ffffffffffffff9f
>   RIP: 0010:afs_put_addrlist+0x43/0x250 fs/afs/addr_list.c:38
>   afs_lookup_server+0xd3f/0x1020 fs/afs/server.c:243
>   afs_alloc_server_list+0x800/0x11a0 fs/afs/server_list.c:82
>   afs_create_volume+0x995/0x1290 fs/afs/volume.c:227
>   afs_get_tree+0x955/0x10b0 fs/afs/super.c:555

It looks like alist is 0xffffffffffffff9f, but it's not immediately obvious
how it could be anything other than a valid pointer at that point.

> Our reproducer.c is available upon request.

If I could have that, please?

Thanks,
David