linux-kernel - Re: [PATCH v2] Fix NULL pointer dereference in read_cache

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <991c8404-1c1c-47c7-ab27-2117d134b59b@gmail.com>
Date: Fri, 4 Oct 2024 14:07:25 +0200
From: Gianfranco Trad <gianf.trad@...il.com>
To: Matthew Wilcox <willy@...radead.org>
Cc: akpm@...ux-foundation.org, linux-fsdevel@...r.kernel.org,
 linux-kernel@...r.kernel.org, linux-mm@...ck.org, skhan@...uxfoundation.org,
 syzbot+4089e577072948ac5531@...kaller.appspotmail.com
Subject: Re: [PATCH v2] Fix NULL pointer dereference in read_cache_folio

On 30/09/24 20:14, Matthew Wilcox wrote:
> On Mon, Sep 30, 2024 at 11:02:26AM +0200, Gianfranco Trad wrote:
>> @@ -2360,6 +2360,8 @@ static int filemap_read_folio(struct file *file, filler_t filler,
>>   	/* Start the actual read. The read will unlock the page. */
>>   	if (unlikely(workingset))
>>   		psi_memstall_enter(&pflags);
>> +	if (!filler)
>> +		return -EIO;
> 
> This is definitely wrong because you enter memstall, but do not exit it.

Got it, thanks.

> 
> As Andrew says, the underlying problem is that the filesystem does not
> implement ->read_folio.  Which filesystem is this?

Reproducer via procfs accesses a bpf map backed by an anonymous
inode (anon_inode_fs_type), with mapping->a_ops pointing to anon_aops,
hence, read_folio() undefined.

> 
>>   	error = filler(file, folio);
>>   	if (unlikely(workingset))
>>   		psi_memstall_leave(&pflags);
>> -- 
>> 2.43.0
>>

I suppose the next step would be to contact the proper maintainers(?)
If you have any additional suggestions, I'd be more than glad to listen.

Thanks to both of you for your time,

--Gian