linux-kernel - [PATCH] fuse: check file before running readpage

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20241114020417.3524632-1-lizhi.xu@windriver.com>
Date: Thu, 14 Nov 2024 10:04:16 +0800
From: Lizhi Xu <lizhi.xu@...driver.com>
To: <syzbot+0b1279812c46e48bb0c1@...kaller.appspotmail.com>
CC: <linux-fsdevel@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
        <miklos@...redi.hu>, <syzkaller-bugs@...glegroups.com>
Subject: [PATCH] fuse: check file before running readpage

syzbot reported a null-ptr-deref in fuse_read_args_fill. [1]

About this case, calltrace is:
erofs_read_superblock()->
  erofs_read_metabuf()->
    erofs_bread()->
      read_mapping_folio()->
        do_read_cache_folio()->
          filemap_read_folio()->
            fuse_read_folio()->
              fuse_do_readpage()->
                fuse_read_args_fill()

erofs_bread() calls read_mapping_folio() passing NULL file, which causes a
NULL pointer dereference in fuse_read_args_fill.
To avoid this issue, need to add a check for file in fuse_read_folio().

[1]
KASAN: null-ptr-deref in range [0x0000000000000060-0x0000000000000067]
CPU: 3 UID: 0 PID: 5947 Comm: syz-executor314 Not tainted 6.12.0-rc5-syzkaller-00044-gc1e939a21eb1 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:fuse_read_args_fill fs/fuse/file.c:631 [inline]
RIP: 0010:fuse_do_readpage+0x276/0x640 fs/fuse/file.c:880
Code: e8 9f c7 91 fe 8b 44 24 10 89 44 24 78 41 89 c4 e8 8f c7 91 fe 48 8d 7b 60 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 1d 03 00 00 48 b8 00 00 00 00 00 fc ff df 48 8b
RSP: 0018:ffffc90006a0f820 EFLAGS: 00010206
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff82fbb4c9
RDX: 000000000000000c RSI: ffffffff82fbb4f1 RDI: 0000000000000060
RBP: 0000000000000000 R08: 0000000000000007 R09: 7fffffffffffffff
R10: 0000000000000fff R11: ffffffff961d4b88 R12: 0000000000001000
R13: ffff8880382b8000 R14: ffff888025153780 R15: ffffc90006a0f8b8
FS:  00007f7583f3d6c0(0000) GS:ffff88806a900000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020000240 CR3: 0000000030d30000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 fuse_read_folio+0xb0/0x100 fs/fuse/file.c:905
 filemap_read_folio+0xc6/0x2a0 mm/filemap.c:2367
 do_read_cache_folio+0x263/0x5c0 mm/filemap.c:3825
 read_mapping_folio include/linux/pagemap.h:1011 [inline]
 erofs_bread+0x34d/0x7e0 fs/erofs/data.c:41
 erofs_read_superblock fs/erofs/super.c:281 [inline]
 erofs_fc_fill_super+0x2b9/0x2500 fs/erofs/super.c:625
 vfs_get_super fs/super.c:1280 [inline]
 get_tree_nodev+0xda/0x190 fs/super.c:1299
 erofs_fc_get_tree+0x1fe/0x2e0 fs/erofs/super.c:723
 vfs_get_tree+0x8f/0x380 fs/super.c:1800
 do_new_mount fs/namespace.c:3507 [inline]
 path_mount+0x14e6/0x1f20 fs/namespace.c:3834
 do_mount fs/namespace.c:3847 [inline]
 __do_sys_mount fs/namespace.c:4057 [inline]
 __se_sys_mount fs/namespace.c:4034 [inline]
 __x64_sys_mount+0x294/0x320 fs/namespace.c:4034
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Reported-and-tested-by: syzbot+0b1279812c46e48bb0c1@...kaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=0b1279812c46e48bb0c1
Signed-off-by: Lizhi Xu <lizhi.xu@...driver.com>
---
 fs/fuse/file.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index dafdf766b1d5..5ce37d1f617c 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -899,7 +899,7 @@ static int fuse_read_folio(struct file *file, struct folio *folio)
 	int err;
 
 	err = -EIO;
-	if (fuse_is_bad(inode))
+	if (fuse_is_bad(inode) || !file)
 		goto out;
 
 	err = fuse_do_readpage(file, page);
-- 
2.43.0