Skip to contentSkip to conversation

erofs: fix NULL dereference of dif->bdev_handle in fscache mode

PATCH In review Jingbo Xu 4 participants 4 messages Nov 14, 2023 – Nov 16, 2023 EROFS file system

lore
Share & tools
lore

Jingbo Xu

author
#0 lore raw

PATCH 1/1 erofs: fix NULL dereference of dif->bdev_handle in fscache mode

Avoid NULL dereference of dif->bdev_handle, as dif->bdev_handle is NULL in fscache mode.

 BUG: kernel NULL pointer dereference, address: 0000000000000000
 RIP: 0010:erofs_map_dev+0xbd/0x1c0
 Call Trace:
  <TASK>
  erofs_fscache_data_read_slice+0xa7/0x340
  erofs_fscache_data_read+0x11/0x30
  erofs_fscache_readahead+0xd9/0x100
  read_pages+0x47/0x1f0
  page_cache_ra_order+0x1e5/0x270
  filemap_get_pages+0xf2/0x5f0
  filemap_read+0xb8/0x2e0
  vfs_read+0x18d/0x2b0
  ksys_read+0x53/0xd0
  do_syscall_64+0x42/0xf0
  entry_SYSCALL_64_after_hwframe+0x6e/0x76
Reported-by Yiqun Leng <[email protected]>
Closes https://bugzilla.openanolis.cn/show_bug.cgi?id=7245
Fixes 49845720080d ("erofs: Convert to use bdev_open_by_path()")
Signed-off-by Jingbo Xu <[email protected]>
---
 fs/erofs/data.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)
fs/erofs/data.c +3 -2
index 029c761670bf..c98aeda8abb2 100644
@@ -220,7 +220,7 @@ int erofs_map_dev(struct super_block *sb, struct erofs_map_dev *map)
 			up_read(&devs->rwsem);
 			return 0;
 		}
-		map->m_bdev = dif->bdev_handle->bdev;
+		map->m_bdev = dif->bdev_handle ? dif->bdev_handle->bdev : NULL;
 		map->m_daxdev = dif->dax_dev;
 		map->m_dax_part_off = dif->dax_part_off;
 		map->m_fscache = dif->fscache;

@@ -238,7 +238,8 @@ int erofs_map_dev(struct super_block *sb, struct erofs_map_dev *map)
 			if (map->m_pa >= startoff &&
 			    map->m_pa < startoff + length) {
 				map->m_pa -= startoff;
-				map->m_bdev = dif->bdev_handle->bdev;
+				map->m_bdev = dif->bdev_handle ?
+					      dif->bdev_handle->bdev : NULL;
 				map->m_daxdev = dif->dax_dev;
 				map->m_dax_part_off = dif->dax_part_off;
 				map->m_fscache = dif->fscache;
Signature · 1 line
2.19.1.6.gb485710b
Reviewed-by on v1 1/1
#1 lore raw
Quoted 19 lines · Jingbo Xu

Avoid NULL dereference of dif->bdev_handle, as dif->bdev_handle is NULL in fscache mode.

  BUG: kernel NULL pointer dereference, address: 0000000000000000
  RIP: 0010:erofs_map_dev+0xbd/0x1c0
  Call Trace:
   <TASK>
   erofs_fscache_data_read_slice+0xa7/0x340
   erofs_fscache_data_read+0x11/0x30
   erofs_fscache_readahead+0xd9/0x100
   read_pages+0x47/0x1f0
   page_cache_ra_order+0x1e5/0x270
   filemap_get_pages+0xf2/0x5f0
   filemap_read+0xb8/0x2e0
   vfs_read+0x18d/0x2b0
   ksys_read+0x53/0xd0
   do_syscall_64+0x42/0xf0
   entry_SYSCALL_64_after_hwframe+0x6e/0x76
Quoted 4 lines
Reported-by Yiqun Leng <[email protected]>
Closes https://bugzilla.openanolis.cn/show_bug.cgi?id=7245
Fixes 49845720080d ("erofs: Convert to use bdev_open_by_path()")
Signed-off-by Jingbo Xu <[email protected]>
Reviewed-by Gao Xiang <[email protected]>

Thanks,
Gao Xiang

reviewer Reviewed-by on v1 1/1
#2 lore raw
In reply to Jingbo Xu
Quoted 19 lines · On Tue, 14 Nov 2023 15:07:04 +0800 Jingbo Xu <[email protected]> wrote:

Avoid NULL dereference of dif->bdev_handle, as dif->bdev_handle is NULL in fscache mode.

 BUG: kernel NULL pointer dereference, address: 0000000000000000
 RIP: 0010:erofs_map_dev+0xbd/0x1c0
 Call Trace:
  <TASK>
  erofs_fscache_data_read_slice+0xa7/0x340
  erofs_fscache_data_read+0x11/0x30
  erofs_fscache_readahead+0xd9/0x100
  read_pages+0x47/0x1f0
  page_cache_ra_order+0x1e5/0x270
  filemap_get_pages+0xf2/0x5f0
  filemap_read+0xb8/0x2e0
  vfs_read+0x18d/0x2b0
  ksys_read+0x53/0xd0
  do_syscall_64+0x42/0xf0
  entry_SYSCALL_64_after_hwframe+0x6e/0x76
Quoted 4 lines
Reported-by Yiqun Leng <[email protected]>
Closes https://bugzilla.openanolis.cn/show_bug.cgi?id=7245
Fixes 49845720080d ("erofs: Convert to use bdev_open_by_path()")
Signed-off-by Jingbo Xu <[email protected]>
Reviewed-by Yue Hu <[email protected]>
maintainer Reviewed-by on v1 1/1
#3 lore raw
In reply to Jingbo Xu
Quoted 19 lines · Jingbo Xu

Avoid NULL dereference of dif->bdev_handle, as dif->bdev_handle is NULL in fscache mode.

  BUG: kernel NULL pointer dereference, address: 0000000000000000
  RIP: 0010:erofs_map_dev+0xbd/0x1c0
  Call Trace:
   <TASK>
   erofs_fscache_data_read_slice+0xa7/0x340
   erofs_fscache_data_read+0x11/0x30
   erofs_fscache_readahead+0xd9/0x100
   read_pages+0x47/0x1f0
   page_cache_ra_order+0x1e5/0x270
   filemap_get_pages+0xf2/0x5f0
   filemap_read+0xb8/0x2e0
   vfs_read+0x18d/0x2b0
   ksys_read+0x53/0xd0
   do_syscall_64+0x42/0xf0
   entry_SYSCALL_64_after_hwframe+0x6e/0x76
Quoted 4 lines
Reported-by Yiqun Leng <[email protected]>
Closes https://bugzilla.openanolis.cn/show_bug.cgi?id=7245
Fixes 49845720080d ("erofs: Convert to use bdev_open_by_path()")
Signed-off-by Jingbo Xu <[email protected]>
Reviewed-by Chao Yu <[email protected]>

Thanks,