linux-kernel - Re: [syzbot] [btrfs?] general protection fault in btrfs_search

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <7f0a7b2d-369c-42ae-9054-7436bc98f7c1@gmx.com>
Date: Fri, 25 Oct 2024 14:49:48 +1030
From: Qu Wenruo <quwenruo.btrfs@....com>
To: Lizhi Xu <lizhi.xu@...driver.com>,
 syzbot+3030e17bd57a73d39bd7@...kaller.appspotmail.com
Cc: clm@...com, dsterba@...e.com, josef@...icpanda.com,
 linux-btrfs@...r.kernel.org, linux-kernel@...r.kernel.org,
 syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [btrfs?] general protection fault in btrfs_search_slot



在 2024/10/25 12:53, Lizhi Xu 写道:
> use the input logical can't find the extent root, so add sanity check for
> extent root before search slot.
>
> #syz test
>
> diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c
> index f8e1d5b2c512..87eaf5dd2d5d 100644
> --- a/fs/btrfs/backref.c
> +++ b/fs/btrfs/backref.c
> @@ -2213,6 +2213,9 @@ int extent_from_logical(struct btrfs_fs_info *fs_info, u64 logical,
>   	key.objectid = logical;
>   	key.offset = (u64)-1;
>
> +	if (!extent_root)
> +		return -ENOENT;

Considering we have a lot of such btrfs_search_slot() without checking
if the csum/extent root is NULL, can we move the check into
btrfs_search_slot()?

Thanks,
Qu
> +
>   	ret = btrfs_search_slot(NULL, extent_root, &key, path, 0, 0);
>   	if (ret < 0)
>   		return ret;
>