From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 64CE81E98E3 for ; Mon, 8 Dec 2025 19:04:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1765220685; cv=none; b=VVSXEqhUDgyQ79IreLqu/9LqXZ11VEbLMw3IgAyrcllDzug5A2j+VIzTFbzS2hdv4k1nLHXOk0ux5OIAvLqG0JJ9lolo8KCdqtHqKwySaoUJkU76oGfFH01A06Of3qeKmcvqnTbhN3f/huI+R7Vne6v9QGVjiBO4UCQcYWmLzOw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1765220685; c=relaxed/simple; bh=IjMXIvAWoi6XeLEgxUx0Oepme8GMKFwrSkN4saSkwMs=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=fIimtozvC7+3SHAZbcFO07Yigb0IKtqIdHP1oogrEQCrgBGqEc9yVH6unjgE1aKuucy764Dphf9SxEHZnrojbzQrlj+2zVuVC/HuRJdLXxdTPm808iFYFbD9vb/hu5rdzYwqbG/lkMBaMaEW+eY2gpaZ6zNk9h2lwo5Lmj8PtJE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=GOS2ijYo; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b=PAKGpK8N; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="GOS2ijYo"; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b="PAKGpK8N" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1765220682; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=xF77s5EIcs0pFYKpiAgo+6DSRM9rfh1uhjncv2O4WTI=; b=GOS2ijYoxxkbY8F+rb9wZzatu/z14U4wAE2wm295cztSK7onDdZ3lDbvpRTTT7IItAQjyb I8Zo2qYtoAAb5JLoG1Y8IQuS3furK7DgCPDDXnjx6J5DpXzdEYhYJ6O00VX0fv9vNUZEvv eVevJn0GjbCLuEP6ZALX3J6AjA/fWbE= Received: from mail-pf1-f200.google.com (mail-pf1-f200.google.com [209.85.210.200]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-694-KGDeuZ6gMI2_oOzVJZX-og-1; Mon, 08 Dec 2025 14:04:41 -0500 X-MC-Unique: KGDeuZ6gMI2_oOzVJZX-og-1 X-Mimecast-MFC-AGG-ID: KGDeuZ6gMI2_oOzVJZX-og_1765220680 Received: by mail-pf1-f200.google.com with SMTP id d2e1a72fcca58-7b6b194cf71so8061778b3a.3 for ; Mon, 08 Dec 2025 11:04:40 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1765220680; x=1765825480; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=xF77s5EIcs0pFYKpiAgo+6DSRM9rfh1uhjncv2O4WTI=; b=PAKGpK8NJPBRe8iVOJLBagMO5DF0w4livBabQVJhA0I3r8znM2JWaRak9Y4CltFWCF Yd2yTJ5L0nLfBCCALZcAERXBIFD1YIjQq6qVcgO9gIzMsGc3ulOdrAGHNRiqoujBCXHG w/sTaZ/GWGNHLfYqMQv9tp8smVpMEOEerliCYm+nN4PgzrlrETa+qPcO6JSi2vL+mZGs kdbAD90ZX0qNuR/q/ItJHzzL6OdEYmzV9tIyzgfrSCf65oPa60LAJnMbHORac34s8LYD 416ESX9fprQ1wxV1qPHDV3KAq6sLTatcM1LsEGsKDd3jvWUCIgqPlRcZlVyjzfhmO7Af FPGA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1765220680; x=1765825480; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=xF77s5EIcs0pFYKpiAgo+6DSRM9rfh1uhjncv2O4WTI=; b=ZeqArtWxj+uP8af/hM/TGJnJk9NtULNaRgv/2vURrozx++Qi6hy69BnqEYCSYZ0OpT yI98RqNdzdJ14VGy6pMcKEungKBKoYtILsE2DlHIA0XAQSbfwve8YR4KJkGK65rGevSX VD4C0MOWswZ5Kfr476J07TpvuZsKkbXwteHIemz7RrsXgv8xoybIRnRQU2mROJ2s1t5B e0GQA8C3QXaRlixb5NSe0JQu+X1LGI1KOO0MhJkwihW7err4BK4zIaLPVYmuzT3pqOLB /Fl4sSvPX2AdLwGKHKX4Z5b0ffZjItzfDZ4iQF0T+iPONsHGD+yEJBwP47SKTPB+PnjP NPEw== X-Forwarded-Encrypted: i=1; AJvYcCUJx1hFpAuHvEjpwTGcaTbmQuqDbih6TagskGrC5rVcmiQ0hs6lv8r0qHCnvd+Rvv1pYYT1rOoCg87l9ng=@vger.kernel.org X-Gm-Message-State: AOJu0YziUksAH0NW+Pc+nHq26GbTnNre9QHWBOZiZoToptiEZkaAcsqI kutxwP+TF7N0+uUFaUqxk5wfP42IBmICLj0gIL0tUrV2AUw3zCAlnCwq4DI0hnu2X4YC0vOxA63 sPzhZG+ciFtF9zyl1MFHoMAytYrIZgyhJmI8DmMyoCVvevXd4NOzQ0J7fRYwn5Pbb X-Gm-Gg: ASbGncuEWMtBqzh8OgsWvji7mNeYFoqDFjYaOFA1pcFAFkY8kpFyqwdlIYUcXl5an43 erl4k5GrPC+VB8XGdu/hvopyq8FQSs0ieQPy9e+5ZOelBBvOSgteAhZkp7pxddC+DYme+3/iG+9 MDm0BgqaM/VXxZwKZ4zJ50apCnupbInGCVgg8LI+na/A6jQh9wQZ9lYSWR9Jcp4VtMF9K37ZYbz xkdJ74ZenGffLgiMJR09K8Y/9uYOsJ9deJvzPAMAmK1faR3KiOs5TpJ0uWA/uhelNRyqvpp0pOl zrHxgHbTJkrfZYiuwAsKSpz/tvezOCT8iXFtxDmGrBI49dvHHdU1OWfLj1w2s0xHn1C2jZDoYuf vvuS386KjPtQ9GnZ20yiqdhlbRNBO9WspeICwQg== X-Received: by 2002:a05:6a00:a256:b0:7b2:2d85:ae6e with SMTP id d2e1a72fcca58-7e8c1661812mr8017264b3a.12.1765220680026; Mon, 08 Dec 2025 11:04:40 -0800 (PST) X-Google-Smtp-Source: AGHT+IETR63z6lgWIYauKnGqR+nIlXaUyKmf3AysXIO96uJ5MtZ+oE030fEEOpOwNFljILUP/AFD0g== X-Received: by 2002:a05:6a00:a256:b0:7b2:2d85:ae6e with SMTP id d2e1a72fcca58-7e8c1661812mr8017238b3a.12.1765220679598; Mon, 08 Dec 2025 11:04:39 -0800 (PST) Received: from dkarn-thinkpadp16vgen1.punetw6.csb ([2402:e280:3e0d:a45:335a:59cd:dd80:b6bf]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-7e7f42a43basm9128555b3a.2.2025.12.08.11.04.35 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 08 Dec 2025 11:04:39 -0800 (PST) From: Deepakkumar Karn To: Alexander Viro Cc: Christian Brauner , Jan Kara , linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, syzbot+e07658f51ca22ab65b4e@syzkaller.appspotmail.com, syzkaller-bugs@googlegroups.com, Deepakkumar Karn Subject: [PATCH v2] fs: add NULL check in drop_buffers() to prevent null-ptr-deref Date: Tue, 9 Dec 2025 00:33:07 +0530 Message-ID: <20251208190306.518502-2-dkarn@redhat.com> X-Mailer: git-send-email 2.52.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit drop_buffers() dereferences the buffer_head pointer returned by folio_buffers() without checking for NULL. This leads to a null pointer dereference when called from try_to_free_buffers() on a folio with no buffers attached. This happens when filemap_release_folio() is called on a folio belonging to a mapping with AS_RELEASE_ALWAYS set but without release_folio address_space operation defined. In such case, folio_needs_release() returns true because of AS_RELEASE_ALWAYS flag, the folio has no private buffer data, causing the try_to_free_buffers() with a folio that has no buffers. Adding NULL check for the buffer_head pointer and return false early if no buffers are attached to the folio. Reported-by: syzbot+e07658f51ca22ab65b4e@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=e07658f51ca22ab65b4e Fixes: 6439476311a6 ("fs: Convert drop_buffers() to use a folio") Signed-off-by: Deepakkumar Karn --- fs/buffer.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/buffer.c b/fs/buffer.c index 838c0c571022..fa5de0cdf540 100644 --- a/fs/buffer.c +++ b/fs/buffer.c @@ -2893,6 +2893,10 @@ drop_buffers(struct folio *folio, struct buffer_head **buffers_to_free) struct buffer_head *head = folio_buffers(folio); struct buffer_head *bh; + /* In cases of folio without buffer_head*/ + if (!head) + return false; + bh = head; do { if (buffer_busy(bh)) -- 2.52.0