linux-kernel - Re: [syzbot] [bcachefs?] [rcu?] BUG: unable to handle kernel NULL pointer dereference in rcu

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aEnVuzK7VhGSizWj@pc636>
Date: Wed, 11 Jun 2025 21:15:07 +0200
From: Uladzislau Rezki <urezki@...il.com>
To: syzbot <syzbot+80e5d6f453f14a53383a@...kaller.appspotmail.com>
Cc: akpm@...ux-foundation.org, josh@...htriplett.org,
	kent.overstreet@...ux.dev, linux-bcachefs@...r.kernel.org,
	linux-kernel@...r.kernel.org, linux-mm@...ck.org,
	paulmck@...nel.org, rcu@...r.kernel.org,
	syzkaller-bugs@...glegroups.com, urezki@...il.com
Subject: Re: [syzbot] [bcachefs?] [rcu?] BUG: unable to handle kernel NULL
 pointer dereference in rcu_core (3)

On Wed, Jun 11, 2025 at 11:02:03AM -0700, syzbot wrote:
> Hello,
> 
> syzbot tried to test the proposed patch but the build/boot failed:
> 
> failed to apply patch:
> checking file kernel/rcu/tree.c
> patch: **** unexpected end of file in patch
> 
> 
> 
> Tested on:
> 
> commit:         aef17cb3 Revert "mm/damon/Kconfig: enable CONFIG_DAMON..
> git tree:       upstream
> kernel config:  https://syzkaller.appspot.com/x/.config?x=523d3ff8e053340a
> dashboard link: https://syzkaller.appspot.com/bug?extid=80e5d6f453f14a53383a
> compiler:       
> patch:          https://syzkaller.appspot.com/x/patch.diff?x=17de99d4580000
> 
#syz test

diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c
index e8a4b720d7d2..14d4499c6fc3 100644
--- a/kernel/rcu/tree.c
+++ b/kernel/rcu/tree.c
@@ -3072,6 +3072,10 @@ __call_rcu_common(struct rcu_head *head, rcu_callback_t func, bool lazy_in)
 	/* Misaligned rcu_head! */
 	WARN_ON_ONCE((unsigned long)head & (sizeof(void *) - 1));
 
+	/* Avoid NULL dereference if callback is NULL. */
+	if (WARN_ON_ONCE(!func))
+		return;
+
 	if (debug_rcu_head_queue(head)) {
 		/*
 		 * Probable double call_rcu(), so leak the callback.