linux-kernel - Re: [syzbot] Re: [syzbot] [f2fs?] KASAN: null-ptr-deref Write in f2fs_stop_gc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <00000000000069d6d4061e085f82@google.com>
Date: Wed, 24 Jul 2024 18:32:49 -0700
From: syzbot <syzbot+1a8e2b31f2ac9bd3d148@...kaller.appspotmail.com>
To: linux-kernel@...r.kernel.org
Subject: Re: [syzbot] Re: [syzbot] [f2fs?] KASAN: null-ptr-deref Write in f2fs_stop_gc_thread

For archival purposes, forwarding an incoming command email to
linux-kernel@...r.kernel.org.

***

Subject: Re: [syzbot] [f2fs?] KASAN: null-ptr-deref Write in f2fs_stop_gc_thread
Author: lizhi.xu@...driver.com

shutting down f2fs set ro, and check bdev_thaw return value

#syz test: upstream 2c9b3512402e

diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
index c1ad9b278c47..0e607cb3bc9a 100644
--- a/fs/f2fs/file.c
+++ b/fs/f2fs/file.c
@@ -2244,7 +2244,9 @@ int f2fs_do_shutdown(struct f2fs_sb_info *sbi, unsigned int flag,
 		if (ret)
 			goto out;
 		f2fs_stop_checkpoint(sbi, false, STOP_CP_REASON_SHUTDOWN);
-		bdev_thaw(sb->s_bdev);
+		ret = bdev_thaw(sb->s_bdev);
+		if (ret == -EINVAL)
+			goto out;
 		break;
 	case F2FS_GOING_DOWN_METASYNC:
 		/* do checkpoint only */
diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
index df4cf31f93df..e507379762ff 100644
--- a/fs/f2fs/super.c
+++ b/fs/f2fs/super.c
@@ -4177,7 +4177,7 @@ void f2fs_handle_critical_error(struct f2fs_sb_info *sbi, unsigned char reason,
 	 * RO by shutdown, since RO bypasses thaw_super which can hang the
 	 * system.
 	 */
-	if (continue_fs || f2fs_readonly(sb) || shutdown) {
+	if (continue_fs || f2fs_readonly(sb)) {
 		f2fs_warn(sbi, "Stopped filesystem due to reason: %d", reason);
 		return;
 	}