linux-kernel - [PATCH] fs: xfs: fix possible NULL pointer dereference in xfs_rw

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 11 Apr 2022 19:31:45 +0800
From:   Zixuan Fu <r33s3n6@...il.com>
To:     djwong@...nel.org
Cc:     linux-xfs@...r.kernel.org, linux-kernel@...r.kernel.org,
        baijiaju1990@...il.com, Zixuan Fu <r33s3n6@...il.com>,
        TOTE Robot <oslab@...nghua.edu.cn>
Subject: [PATCH] fs: xfs: fix possible NULL pointer dereference in xfs_rw_bdev()

In our fault-injection testing, bio_alloc() may fail with low memory and
return NULL. In this case, the variable "bio" in xfs_rw_bdev() would be
NULL and then it is dereferenced in "bio_set_dev(bio, bdev)".

The failure log is listed as follows:

[   16.009947] BUG: kernel NULL pointer dereference, address: 0000000000000015
...
[   16.012406] RIP: 0010:bio_set_dev+0x76/0x160 [xfs]
...
[   16.017773] Call Trace:
[   16.017925]  <TASK>
[   16.018065]  xfs_rw_bdev+0x29e/0x9f0 [xfs]
[   16.018396]  ? _raw_spin_unlock_irqrestore+0x3c/0x70
[   16.018697]  xlog_do_io+0x183/0x4a0 [xfs]
[   16.019019]  xlog_bwrite+0x73/0xc0 [xfs]
[   16.019333]  xlog_write_log_records+0x457/0x5c0 [xfs]
[   16.019723]  xlog_clear_stale_blocks+0x2d1/0x430 [xfs]
[   16.020107]  xlog_find_tail+0x63d/0xb60 [xfs]
[   16.020447]  xlog_recover+0x77/0x650 [xfs]
[   16.021101]  xfs_log_mount+0x720/0xcf0 [xfs]
[   16.021437]  xfs_mountfs+0xf0c/0x2440 [xfs]
[   16.021767]  xfs_fs_fill_super+0x1eaa/0x21e0 [xfs]
[   16.022132]  get_tree_bdev+0x3c3/0x5f0
[   16.022361]  ? xfs_fs_warn_deprecated+0x100/0x100 [xfs]
[   16.022750]  xfs_fs_get_tree+0x68/0xb0 [xfs]
[   16.023090]  vfs_get_tree+0x81/0x220
[   16.023308]  path_mount+0x1061/0x2340
[   16.023532]  ? kasan_quarantine_put+0x2c/0x1a0
[   16.023804]  ? slab_free_freelist_hook+0xde/0x160
[   16.024087]  ? mark_mounts_for_expiry+0x410/0x410
[   16.024370]  ? user_path_at_empty+0xf6/0x160
[   16.024629]  ? kmem_cache_free+0xb8/0x1a0
[   16.024876]  ? user_path_at_empty+0xf6/0x160
[   16.025134]  __se_sys_mount+0x217/0x2b0
[   16.025367]  ? __x64_sys_mount+0xd0/0xd0
[   16.025605]  ? exit_to_user_mode_prepare+0x32/0x130
[   16.025899]  do_syscall_64+0x41/0x90
[   16.026116]  entry_SYSCALL_64_after_hwframe+0x44/0xae
...
[   16.030310]  </TASK>

This patch adds a NULL check of "bio" and return -ENOMEM if it's NULL.

Reported-by: TOTE Robot <oslab@...nghua.edu.cn>
Signed-off-by: Zixuan Fu <r33s3n6@...il.com>
---
 fs/xfs/xfs_bio_io.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/xfs/xfs_bio_io.c b/fs/xfs/xfs_bio_io.c
index ae4345b37621..37887029a6c7 100644
--- a/fs/xfs/xfs_bio_io.c
+++ b/fs/xfs/xfs_bio_io.c
@@ -28,6 +28,8 @@ xfs_rw_bdev(
 
 	bio = bio_alloc(bdev, bio_max_vecs(left), op | REQ_META | REQ_SYNC,
 			GFP_KERNEL);
+	if (!bio)
+		return -ENOMEM;
 	bio->bi_iter.bi_sector = sector;
 
 	do {
-- 
2.25.1