From: Zixuan Fu <r33s3n6@gmail.com>
To: djwong@kernel.org
Cc: linux-xfs@vger.kernel.org, linux-kernel@vger.kernel.org,
baijiaju1990@gmail.com, Zixuan Fu <r33s3n6@gmail.com>,
TOTE Robot <oslab@tsinghua.edu.cn>
Subject: [PATCH] fs: xfs: fix possible NULL pointer dereference in xfs_rw_bdev()
Date: Mon, 11 Apr 2022 19:31:45 +0800 [thread overview]
Message-ID: <20220411113145.797121-1-r33s3n6@gmail.com> (raw)
In our fault-injection testing, bio_alloc() may fail with low memory and
return NULL. In this case, the variable "bio" in xfs_rw_bdev() would be
NULL and then it is dereferenced in "bio_set_dev(bio, bdev)".
The failure log is listed as follows:
[ 16.009947] BUG: kernel NULL pointer dereference, address: 0000000000000015
...
[ 16.012406] RIP: 0010:bio_set_dev+0x76/0x160 [xfs]
...
[ 16.017773] Call Trace:
[ 16.017925] <TASK>
[ 16.018065] xfs_rw_bdev+0x29e/0x9f0 [xfs]
[ 16.018396] ? _raw_spin_unlock_irqrestore+0x3c/0x70
[ 16.018697] xlog_do_io+0x183/0x4a0 [xfs]
[ 16.019019] xlog_bwrite+0x73/0xc0 [xfs]
[ 16.019333] xlog_write_log_records+0x457/0x5c0 [xfs]
[ 16.019723] xlog_clear_stale_blocks+0x2d1/0x430 [xfs]
[ 16.020107] xlog_find_tail+0x63d/0xb60 [xfs]
[ 16.020447] xlog_recover+0x77/0x650 [xfs]
[ 16.021101] xfs_log_mount+0x720/0xcf0 [xfs]
[ 16.021437] xfs_mountfs+0xf0c/0x2440 [xfs]
[ 16.021767] xfs_fs_fill_super+0x1eaa/0x21e0 [xfs]
[ 16.022132] get_tree_bdev+0x3c3/0x5f0
[ 16.022361] ? xfs_fs_warn_deprecated+0x100/0x100 [xfs]
[ 16.022750] xfs_fs_get_tree+0x68/0xb0 [xfs]
[ 16.023090] vfs_get_tree+0x81/0x220
[ 16.023308] path_mount+0x1061/0x2340
[ 16.023532] ? kasan_quarantine_put+0x2c/0x1a0
[ 16.023804] ? slab_free_freelist_hook+0xde/0x160
[ 16.024087] ? mark_mounts_for_expiry+0x410/0x410
[ 16.024370] ? user_path_at_empty+0xf6/0x160
[ 16.024629] ? kmem_cache_free+0xb8/0x1a0
[ 16.024876] ? user_path_at_empty+0xf6/0x160
[ 16.025134] __se_sys_mount+0x217/0x2b0
[ 16.025367] ? __x64_sys_mount+0xd0/0xd0
[ 16.025605] ? exit_to_user_mode_prepare+0x32/0x130
[ 16.025899] do_syscall_64+0x41/0x90
[ 16.026116] entry_SYSCALL_64_after_hwframe+0x44/0xae
...
[ 16.030310] </TASK>
This patch adds a NULL check of "bio" and return -ENOMEM if it's NULL.
Reported-by: TOTE Robot <oslab@tsinghua.edu.cn>
Signed-off-by: Zixuan Fu <r33s3n6@gmail.com>
---
fs/xfs/xfs_bio_io.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/fs/xfs/xfs_bio_io.c b/fs/xfs/xfs_bio_io.c
index ae4345b37621..37887029a6c7 100644
--- a/fs/xfs/xfs_bio_io.c
+++ b/fs/xfs/xfs_bio_io.c
@@ -28,6 +28,8 @@ xfs_rw_bdev(
bio = bio_alloc(bdev, bio_max_vecs(left), op | REQ_META | REQ_SYNC,
GFP_KERNEL);
+ if (!bio)
+ return -ENOMEM;
bio->bi_iter.bi_sector = sector;
do {
--
2.25.1
next reply other threads:[~2022-04-11 11:31 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-04-11 11:31 Zixuan Fu [this message]
2022-04-11 14:55 ` [PATCH] fs: xfs: fix possible NULL pointer dereference in xfs_rw_bdev() Christoph Hellwig
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220411113145.797121-1-r33s3n6@gmail.com \
--to=r33s3n6@gmail.com \
--cc=baijiaju1990@gmail.com \
--cc=djwong@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-xfs@vger.kernel.org \
--cc=oslab@tsinghua.edu.cn \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox