linux-kernel - [PATCH] fs/9p: fix NULL pointer dereference on mkdir

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <E1tsiI6-002iMG-Kh@kylie.crudebyte.com>
Date: Thu, 13 Mar 2025 13:59:32 +0100
From: Christian Schoenebeck <linux_oss@...debyte.com>
To: Dominique Martinet <asmadeus@...ewreck.org>
Cc: Eric Van Hensbergen <ericvh@...nel.org>,
    Latchesar Ionkov <lucho@...kov.net>,
    v9fs@...ts.linux.dev,
    linux-kernel@...r.kernel.org,
    syzbot <syzbot+5b667f9a1fee4ba3775a@...kaller.appspotmail.com>
Subject: [PATCH] fs/9p: fix NULL pointer dereference on mkdir

When a 9p tree was mounted with option 'posixacl', parent directory had a
default ACL set for its subdirectories, e.g.:

  setfacl -m default:group:simpsons:rwx parentdir

then creating a subdirectory crashed 9p client, as v9fs_fid_add() call in
function v9fs_vfs_mkdir_dotl() sets the passed 'fid' pointer to NULL
(since dafbe689736) even though the subsequent v9fs_set_create_acl() call
expects a valid non-NULL 'fid' pointer:

  [   37.273191] BUG: kernel NULL pointer dereference, address: 0000000000000000
  ...
  [   37.322338] Call Trace:
  [   37.323043]  <TASK>
  [   37.323621]  ? __die+0x1f/0x60
  [   37.324448]  ? page_fault_oops+0x158/0x470
  [   37.325532]  ? search_module_extables+0x4a/0x80
  [   37.326742]  ? p9_client_walk+0x1c/0x2c0 [9pnet]
  [   37.328006]  ? search_bpf_extables+0x5b/0x80
  [   37.329142]  ? exc_page_fault+0x72/0x190
  [   37.330196]  ? asm_exc_page_fault+0x22/0x30
  [   37.331330]  ? p9_client_walk+0x1c/0x2c0 [9pnet]
  [   37.332562]  ? v9fs_fid_xattr_get+0x59/0x120 [9p]
  [   37.333824]  v9fs_fid_xattr_set+0x6f/0x130 [9p]
  [   37.335077]  v9fs_set_acl+0x82/0xc0 [9p]
  [   37.336112]  v9fs_set_create_acl+0x41/0x60 [9p]
  [   37.337326]  v9fs_vfs_mkdir_dotl+0x20d/0x2e0 [9p]
  [   37.338590]  vfs_mkdir+0x192/0x250
  [   37.339535]  do_mkdirat+0x135/0x160
  [   37.340465]  __x64_sys_mkdir+0x42/0x60
  [   37.341455]  do_syscall_64+0x4b/0x110
  [   37.342447]  entry_SYSCALL_64_after_hwframe+0x76/0x7e

Fix this by simply swapping the sequence of these two calls in
v9fs_vfs_mkdir_dotl(), i.e. calling v9fs_set_create_acl() before
v9fs_fid_add().

Fixes: dafbe689736 ('9p fid refcount: cleanup p9_fid_put calls')
Reported-by: syzbot+5b667f9a1fee4ba3775a@...kaller.appspotmail.com
Signed-off-by: Christian Schoenebeck <linux_oss@...debyte.com>
---
 fs/9p/vfs_inode_dotl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/9p/vfs_inode_dotl.c b/fs/9p/vfs_inode_dotl.c
index 143ac03b7425..3397939fd2d5 100644
--- a/fs/9p/vfs_inode_dotl.c
+++ b/fs/9p/vfs_inode_dotl.c
@@ -407,8 +407,8 @@ static int v9fs_vfs_mkdir_dotl(struct mnt_idmap *idmap,
 			 err);
 		goto error;
 	}
-	v9fs_fid_add(dentry, &fid);
 	v9fs_set_create_acl(inode, fid, dacl, pacl);
+	v9fs_fid_add(dentry, &fid);
 	d_instantiate(dentry, inode);
 	err = 0;
 	inc_nlink(dir);
-- 
2.39.5