[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <tencent_9D1D4FB28DB4A59E0DBD9245DD84DDDC9907@qq.com>
Date: Sun, 3 Nov 2024 22:36:40 +0800
From: Edward Adam Davis <eadavis@...com>
To: syzbot+f51a2a34984e4d8888fd@...kaller.appspotmail.com
Cc: aivazian.tigran@...il.com,
linux-kernel@...r.kernel.org,
syzkaller-bugs@...glegroups.com
Subject: [PATCH] bfs: add check for return value of sb_getblk
Syzbot reported a null-ptr-deref in bfs_move_block.
sb_getblk() can fail, so need to check its return value.
If returned buffer head is not uptodate, it is considered corrupt.
Reported-and-tested-by: syzbot+f51a2a34984e4d8888fd@...kaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=f51a2a34984e4d8888fd
Signed-off-by: Edward Adam Davis <eadavis@...com>
---
fs/bfs/file.c | 14 +++++++++++++-
1 file changed, 13 insertions(+), 1 deletion(-)
diff --git a/fs/bfs/file.c b/fs/bfs/file.c
index fa66a09e496a..983cc191d1e3 100644
--- a/fs/bfs/file.c
+++ b/fs/bfs/file.c
@@ -35,16 +35,28 @@ static int bfs_move_block(unsigned long from, unsigned long to,
struct super_block *sb)
{
struct buffer_head *bh, *new;
+ int err = 0;
bh = sb_bread(sb, from);
if (!bh)
return -EIO;
new = sb_getblk(sb, to);
+ if (!new) {
+ bforget(bh);
+ return -ENOMEM;
+ }
+
+ if (!buffer_uptodate(new)) {
+ err = -EIO;
+ goto out;
+ }
+
memcpy(new->b_data, bh->b_data, bh->b_size);
mark_buffer_dirty(new);
+out:
bforget(bh);
brelse(new);
- return 0;
+ return err;
}
static int bfs_move_blocks(struct super_block *sb, unsigned long start,
--
2.43.0
Powered by blists - more mailing lists