linux-kernel - Re: [syzbot] [block?] BUG: unable to handle kernel NULL pointer dereference in __bio_release

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Tue, 16 Jan 2024 18:42:31 +0000
From: Matthew Wilcox <willy@...radead.org>
To: Jens Axboe <axboe@...nel.dk>
Cc: syzbot <syzbot+004c1e0fced2b4bc3dcc@...kaller.appspotmail.com>,
	linux-block@...r.kernel.org, linux-kernel@...r.kernel.org,
	syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [block?] BUG: unable to handle kernel NULL pointer
 dereference in __bio_release_pages

On Tue, Jan 16, 2024 at 11:00:52AM -0700, Jens Axboe wrote:
> On 1/16/24 2:57 AM, syzbot wrote:
> > pstate: 10000005 (nzcV daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
> > pc : _compound_head include/linux/page-flags.h:247 [inline]
> > pc : bio_first_folio include/linux/bio.h:289 [inline]
> > pc : __bio_release_pages+0x100/0x73c block/bio.c:1153
> > lr : bio_release_pages include/linux/bio.h:508 [inline]
> > lr : blkdev_bio_end_io+0x2a0/0x3f0 block/fops.c:157
> > sp : ffff800089a375e0
> > x29: ffff800089a375e0 x28: 1fffe0000162e879 x27: ffff00000b1743c0
> > x26: ffff00000b1743c8 x25: 000000000000000a x24: 1fffe000015a9e12
> > x23: ffff00000ad4f094 x22: ffff00000f496600 x21: 1fffe0000162e87a
> > x20: 0000000000000004 x19: 0000000000000000 x18: ffff00000b174432
> > x17: ffff00000b174438 x16: ffff00000f948008 x15: 1fffe0000162e886
> > x14: ffff00000b1743d4 x13: 00000000f1f1f1f1 x12: ffff6000015a9e13
> > x11: 1fffe000015a9e12 x10: ffff6000015a9e12 x9 : dfff800000000000
> > x8 : ffff00000b1743d4 x7 : 0000000041b58ab3 x6 : 1ffff00011346ed0
> > x5 : ffff700011346ed0 x4 : 00000000f1f1f1f1 x3 : 000000000000f1f1
> > x2 : 0000000000000001 x1 : dfff800000000000 x0 : 0000000000000008
> > Call trace:
> >  _compound_head include/linux/page-flags.h:247 [inline]
> >  bio_first_folio include/linux/bio.h:289 [inline]
> >  __bio_release_pages+0x100/0x73c block/bio.c:1153
> >  bio_release_pages include/linux/bio.h:508 [inline]
> >  blkdev_bio_end_io+0x2a0/0x3f0 block/fops.c:157
> >  bio_endio+0x4a4/0x618 block/bio.c:1608
> 
> This looks to be caused by:
> 
> commit 1b151e2435fc3a9b10c8946c6aebe9f3e1938c55
> Author: Matthew Wilcox (Oracle) <willy@...radead.org>
> Date:   Mon Aug 14 15:41:00 2023 +0100
> 
>     block: Remove special-casing of compound pages

This looks familiar ... looks like it came up right before Xmas and
I probably dropped the patch on the floor?

https://lore.kernel.org/all/ZX07SsSqIQ2TYwEi@casper.infradead.org/

diff --git a/include/linux/bio.h b/include/linux/bio.h
index ec4db73e5f4e..1518f1201ddd 100644
--- a/include/linux/bio.h
+++ b/include/linux/bio.h
@@ -286,6 +286,11 @@ static inline void bio_first_folio(struct folio_iter *fi, struct bio *bio,
 {
 	struct bio_vec *bvec = bio_first_bvec_all(bio) + i;
 
+	if (i >= bio->bi_vcnt) {
+		fi->folio = NULL;
+		return;
+	}
+
 	fi->folio = page_folio(bvec->bv_page);
 	fi->offset = bvec->bv_offset +
 			PAGE_SIZE * (bvec->bv_page - &fi->folio->page);
@@ -303,10 +308,8 @@ static inline void bio_next_folio(struct folio_iter *fi, struct bio *bio)
 		fi->offset = 0;
 		fi->length = min(folio_size(fi->folio), fi->_seg_count);
 		fi->_next = folio_next(fi->folio);
-	} else if (fi->_i + 1 < bio->bi_vcnt) {
-		bio_first_folio(fi, bio, fi->_i + 1);
 	} else {
-		fi->folio = NULL;
+		bio_first_folio(fi, bio, fi->_i + 1);
 	}
 }