linux-kernel - Re: [syzbot] [fuse?] general protection fault in fuse_do

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20241104013708.3134548-1-lizhi.xu@windriver.com>
Date: Mon, 4 Nov 2024 09:37:08 +0800
From: Lizhi Xu <lizhi.xu@...driver.com>
To: <syzbot+0b1279812c46e48bb0c1@...kaller.appspotmail.com>
CC: <linux-fsdevel@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
        <miklos@...redi.hu>, <syzkaller-bugs@...glegroups.com>
Subject: Re: [syzbot] [fuse?] general protection fault in fuse_do_readpage

about this case, calltrace is:
erofs_read_superblock()->
	erofs_read_metabuf()->
		erofs_bread()->
			read_mapping_folio()
	
41                  folio = read_mapping_folio(buf->mapping, index, NULL);
file is NULL in read_mapping_folio() at fs/erofs/data.c, and in fuse_do_readpage(),
it need file pass node id and file handle(in userspace), so need to add a
check for file in fuse_read_folio().

#syz test

diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index f33fbce86ae0..fe6df701da24 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -902,6 +902,9 @@ static int fuse_read_folio(struct file *file, struct folio *folio)
 	if (fuse_is_bad(inode))
 		goto out;
 
+	if (!file)
+		goto out;
+
 	err = fuse_do_readpage(file, page);
 	fuse_invalidate_atime(inode);
  out: