Re: [syzbot] Re: [syzbot] [jfs?] KASAN: null-ptr-deref Read in drop_buffers (3)

syzbot
2025-04-18T09:46:42Z

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.

***

Subject: Re: [syzbot] [jfs?] KASAN: null-ptr-deref Read in drop_buffers (3)
Author: richard120310@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git cb82ca153949

Signed-off-by: I Hsin Cheng <richard120310@gmail.com>
---
fs/buffer.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/fs/buffer.c b/fs/buffer.c
index cc8452f60251..1e3a07c66c1a 100644
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -2885,7 +2885,7 @@ drop_buffers(struct folio *folio, struct buffer_head **buffers_to_free)

bh = head;
do {
- if (buffer_busy(bh))
+ if (!bh || buffer_busy(bh))
goto failed;
bh = bh->b_this_page;
} while (bh != head);
@@ -2896,6 +2896,8 @@ drop_buffers(struct folio *folio, struct buffer_head **buffers_to_free)
if (bh->b_assoc_map)
__remove_assoc_queue(bh);
bh = next;
+ if (!bh)
+ goto failed;
} while (bh != head);
*buffers_to_free = head;
folio_detach_private(folio);
--
2.43.0