linux-kernel - Re: [PATCH] bcachefs: Fix NULL ptr dereference in btree_node_iter_and_journal

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <09A7740A-3113-4ABF-8587-8E0A4231DD61@gmail.com>
Date: Wed, 23 Oct 2024 15:33:22 +0800
From: Alan Huang <mmpgouride@...il.com>
To: Piotr Zalewski <pZ010001011111@...ton.me>
Cc: Kent Overstreet <kent.overstreet@...ux.dev>,
 linux-bcachefs@...r.kernel.org,
 LKML <linux-kernel@...r.kernel.org>,
 skhan@...uxfoundation.org,
 syzbot+005ef9aa519f30d97657@...kaller.appspotmail.com
Subject: Re: [PATCH] bcachefs: Fix NULL ptr dereference in
 btree_node_iter_and_journal_peek

On Oct 23, 2024, at 15:21, Piotr Zalewski <pZ010001011111@...ton.me> wrote:
> 
> Add NULL check for key returned from bch2_btree_and_journal_iter_peek in
> btree_node_iter_and_journal_peek to avoid NULL ptr dereference in
> bch2_bkey_buf_reassemble.

It would be helpful if the commit message explained why k.k is null in this case

> 
> Reported-by: syzbot+005ef9aa519f30d97657@...kaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=005ef9aa519f30d97657
> Fixes: 5222a4607cd8 ("bcachefs: BTREE_ITER_WITH_JOURNAL")
> Signed-off-by: Piotr Zalewski <pZ010001011111@...ton.me>
> ---
> fs/bcachefs/btree_iter.c | 3 +++
> 1 file changed, 3 insertions(+)
> 
> diff --git a/fs/bcachefs/btree_iter.c b/fs/bcachefs/btree_iter.c
> index 0883cf6e1a3e..625167ce191f 100644
> --- a/fs/bcachefs/btree_iter.c
> +++ b/fs/bcachefs/btree_iter.c
> @@ -882,6 +882,8 @@ static noinline int btree_node_iter_and_journal_peek(struct btree_trans *trans,
> __bch2_btree_and_journal_iter_init_node_iter(trans, &jiter, l->b, l->iter, path->pos);
> 
> k = bch2_btree_and_journal_iter_peek(&jiter);
> + if (!k.k)
> + goto err;
> 
> bch2_bkey_buf_reassemble(out, c, k);
> 
> @@ -889,6 +891,7 @@ static noinline int btree_node_iter_and_journal_peek(struct btree_trans *trans,
>    c->opts.btree_node_prefetch)
> ret = btree_path_prefetch_j(trans, path, &jiter);
> 
> +err:
> bch2_btree_and_journal_iter_exit(&jiter);
> return ret;
> }
> -- 
> 2.47.0
> 
> 
>