linux-kernel - [PATCH] bcachefs: fix potential NULL deref in bch2_sb_members_v2

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20251202172047.216045-1-mdmitrichenko@astralinux.ru>
Date: Tue,  2 Dec 2025 20:20:46 +0300
From: Mikhail Dmitrichenko <mdmitrichenko@...ralinux.ru>
To: Kent Overstreet <kent.overstreet@...ux.dev>
Cc: Mikhail Dmitrichenko <mdmitrichenko@...ralinux.ru>,
	linux-bcachefs@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	lvc-project@...uxtesting.org
Subject: [PATCH] bcachefs: fix potential NULL deref in bch2_sb_members_v2_init

bch2_sb_members_v2_init calls bch2_sb_field_resize to allocate the
members_v2 superblock field, but does not check the returned pointer
before dereferencing it. bch2_sb_field_resize may return NULL if
superblock reallocation fails. In this case dereferencing mi2=NULL
will cause crash during superblock upgrade from members_v1 to members_v2.

Add check for bch2_sb_field_resize call result for NULL.
sb_members_v2_resize_entries function already has such check and returns
error in this case. Make bch2_sb_members_v2_init() consistent and return
the same error.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 3f7b9713dae0 ("bcachefs: New superblock section members_v2")
Signed-off-by: Mikhail Dmitrichenko <mdmitrichenko@...ralinux.ru>
---
 fs/bcachefs/sb/members.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/bcachefs/sb/members.c b/fs/bcachefs/sb/members.c
index 8bf8f5ca3470..a610426b6013 100644
--- a/fs/bcachefs/sb/members.c
+++ b/fs/bcachefs/sb/members.c
@@ -116,6 +116,9 @@ int bch2_sb_members_v2_init(struct bch_fs *c)
 				DIV_ROUND_UP(sizeof(*mi2) +
 					     sizeof(struct bch_member) * c->sb.nr_devices,
 					     sizeof(u64)));
+		if (!mi2)
+			return bch_err_throw(c, ENOSPC_sb_members_v2);
+
 		mi1 = bch2_sb_field_get(c->disk_sb.sb, members_v1);
 		memcpy(&mi2->_members[0], &mi1->_members[0],
 		       BCH_MEMBER_V1_BYTES * c->sb.nr_devices);
-- 
2.39.2