linux-kernel - Re: [PATCH] fs/buffer: add alert in try_to_free

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <pt6xr3w5ne22gqvgxzbdhwfm45wiiwqmycajofgnnzlrzowmeh@iek3vsmkvs5j>
Date: Thu, 11 Dec 2025 10:23:53 +0100
From: Jan Kara <jack@...e.cz>
To: Deepakkumar Karn <dkarn@...hat.com>
Cc: Alexander Viro <viro@...iv.linux.org.uk>, 
	Christian Brauner <brauner@...nel.org>, Jan Kara <jack@...e.cz>, linux-kernel@...r.kernel.org, 
	linux-fsdevel@...r.kernel.org
Subject: Re: [PATCH] fs/buffer: add alert in try_to_free_buffers() for folios
 without buffers

On Wed 10-12-25 23:32:28, Deepakkumar Karn wrote:
> try_to_free_buffers() can be called on folios with no buffers attached
> when filemap_release_folio() is invoked on a folio belonging to a mapping
> with AS_RELEASE_ALWAYS set but no release_folio operation defined.
> 
> In such cases, folio_needs_release() returns true because of the
> AS_RELEASE_ALWAYS flag, but the folio has no private buffer data. This
> causes try_to_free_buffers() to call drop_buffers() on a folio with no
> buffers, leading to a null pointer dereference.
> 
> Adding a check in try_to_free_buffers() to return early if the folio has no
> buffers attached, with WARN_ON_ONCE() to alert about the misconfiguration.
> This provides defensive hardening.
> 
> Signed-off-by: Deepakkumar Karn <dkarn@...hat.com>
> ---
>  fs/buffer.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/fs/buffer.c b/fs/buffer.c
> index 838c0c571022..b229baa77055 100644
> --- a/fs/buffer.c
> +++ b/fs/buffer.c
> @@ -2948,6 +2948,10 @@ bool try_to_free_buffers(struct folio *folio)
>  	if (folio_test_writeback(folio))
>  		return false;
>  
> +	/* Misconfigured folio check */
> +	if (WARN_ON_ONCE(!folio_buffers(folio)))
> +		return false;

This should really be returning true. Otherwise the folio will never get
released.

								Honza

> +
>  	if (mapping == NULL) {		/* can this still happen? */
>  		ret = drop_buffers(folio, &buffers_to_free);
>  		goto out;
> -- 
> 2.52.0
> 
-- 
Jan Kara <jack@...e.com>
SUSE Labs, CR