linux-kernel - PROBLEM: NULL pointer dereference error in the "ufs_put_super

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2802cec3.265e.18b36b6261e.Coremail.huangsicong@iie.ac.cn>
Date:   Mon, 16 Oct 2023 12:19:48 +0800 (GMT+08:00)
From:   黄思聪 <huangsicong@....ac.cn>
To:     dushistov@...l.ru
Cc:     linux-kernel@...r.kernel.org
Subject: PROBLEM: NULL pointer dereference error in the
 "ufs_put_super_internal" function

NULL pointer dereference error may occur in "ufs_put_super_internal" function.

The "ufs_put_super_internal" function located in "fs/ufs/super.c" may occur a NULL pointer dereference error when it calls the function "ubh_memcpyubh" defined in "fs/ufs/util.c". The relevant code definitions are as follows:
ubh = ubh_bread(sb, uspi-&gt;s_csaddr + i, size);  
ubh_memcpyubh (ubh, space, size);

It will call "ubh_bread" function to allocate enough memory to store the variable "ubh". The "ubh_bread" function may return NULL in various situations, especially when calling "kmalloc" function. If there are significant memory fragmentation issues, insufficient free memory blocks, or internal errors in the allocation function, the "kmalloc" function will return NULL. Finally, the "ubh" variable will get NULL， and the "ubh" will be passed as the first parameter to the "ubh_memcpyubh" function.  This function will execute the following code snippet:
if (size &gt; (ubh-&gt;count &lt;&lt; uspi-&gt;s_fshift))
size = ubh-&gt;count &lt;&lt; uspi-&gt;s_fshift;

If the "ubh" variable is NULL, it will cause an error. So I think that a null pointer check should be added in the function "ufs_put_super_internal".

My experimental kernel version is "LINUX 6.1", and this problem exists in all the version from "LINUX v3.0-rc1" to "LINUX v6.6-rc5".

Best regards,
Sicong Huang