linux-kernel - Re: [PATCH] filemap: fix error pointer dereference in filemap

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <ZpXbLr0JeybnV6af@casper.infradead.org>
Date: Tue, 16 Jul 2024 03:30:06 +0100
From: Matthew Wilcox <willy@...radead.org>
To: Ma Ke <make24@...as.ac.cn>
Cc: akpm@...ux-foundation.org, linux-fsdevel@...r.kernel.org,
	linux-mm@...ck.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] filemap: fix error pointer dereference in filemap_fault()

On Tue, Jul 16, 2024 at 10:25:18AM +0800, Ma Ke wrote:
> This code calls folio_put() on an error pointer which will lead to a
> crash.  Check for both error pointers and NULL pointers before calling
> folio_put().

Have you observed this, or do you just think this can happen?

If the former, please share the crash.
If the latter, please document the path which can lead to this
happening.

> Fixes: 38a55db9877c ("filemap: Handle error return from __filemap_get_folio()")
> Signed-off-by: Ma Ke <make24@...as.ac.cn>
> ---
>  mm/filemap.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/mm/filemap.c b/mm/filemap.c
> index 657bcd887fdb..cd26617d8987 100644
> --- a/mm/filemap.c
> +++ b/mm/filemap.c
> @@ -3420,7 +3420,7 @@ vm_fault_t filemap_fault(struct vm_fault *vmf)
>  	 * re-find the vma and come back and find our hopefully still populated
>  	 * page.
>  	 */
> -	if (!IS_ERR(folio))
> +	if (!IS_ERR_OR_NULL(folio))
>  		folio_put(folio);
>  	if (mapping_locked)
>  		filemap_invalidate_unlock_shared(mapping);
> -- 
> 2.25.1
>