From nobody Mon Apr 6 08:06:22 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E0D79C38145 for ; Thu, 8 Sep 2022 21:17:53 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229939AbiIHVRv (ORCPT ); Thu, 8 Sep 2022 17:17:51 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:39672 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229660AbiIHVRq (ORCPT ); Thu, 8 Sep 2022 17:17:46 -0400 Received: from mail-pj1-x102b.google.com (mail-pj1-x102b.google.com [IPv6:2607:f8b0:4864:20::102b]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CFA141017C1 for ; Thu, 8 Sep 2022 14:17:43 -0700 (PDT) Received: by mail-pj1-x102b.google.com with SMTP id o4so19001582pjp.4 for ; Thu, 08 Sep 2022 14:17:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=openresty.com; s=google; h=message-id:date:subject:cc:to:from:from:to:cc:subject:date; bh=1vH0xwAwu857qan4VhlR5/CP90WnznqN8sYcRDZICDI=; b=gk2T77pZStWaE9I/LqZa9c/bsifhcll3rtR6/fuLmnHZ/awo/H8bGlIFRRUDD+vETi towhPxtzCYTUn9pkzSmxzV945mtXgao4gJOnF3+h33jtXFUU5+43QFLY8Eaac/XWeU6n az9u7NRr0n3kaSLEq44j4F2lGfgmUTCZ2H6W/05sFO9IAfAABugwXYCscy4QVLg3oZlq N9p03h2qHahtM6f4Tw6aP203Me92JQGYB+DRWcZqOCBjkBCgevgjQeKaHMnHZHkM6tzj 4w4LHDtA4Hcjb4thTHEj4GZc/NHC6dXe5bIb9sddO5BE63FB6m8ENUmnbhqEMxLndQuo gkKA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date; bh=1vH0xwAwu857qan4VhlR5/CP90WnznqN8sYcRDZICDI=; b=YQyEdcmxjlLN8SYbOaTjMK7D2kZbKl+oVF3H0vP2exCz6MAVcgR20W0b8cJXooo2rC 0IB7Iu5es+FUeFcysPYhmNo1d7KCGzVRjAPQCOLUsRLZt8I5eIFEJc9WCdIzIbMqM54u 16MBsgGt+d1HhYzne7oFbfX87J5MNGibQp4foAVn8RSYBHPJb3LWG8OCCskfmMujw/mz 3NM/b1w9SQm2z6yQRl4sF/uOB+IRHl6vAyAlvgCpUI+0NB3GZjs+5cn2sHY16G9pfE3v OjlouIdQiEZHr8j9cgydnkauu+J21Y+mEdNHAzMQXF6ujmPEO4E+lrq9PS3NIK+nXaEG rAOw== X-Gm-Message-State: ACgBeo2YZknHaK8hfAQjdpoODZAibi9P6RNb6+XVRDFbX/R4CBg6BUio ydufecmtei0c3nLVK8ij3j5c3miGVlQ30Q== X-Google-Smtp-Source: AA6agR406OgVPwuy7NM5Fgfa+SA+jopPEu8bBwU13dMzAfJWMQfbzvKO+PqomEr74863czx6xmVe/g== X-Received: by 2002:a17:902:e8d1:b0:172:9bc0:bc9d with SMTP id v17-20020a170902e8d100b001729bc0bc9dmr10827487plg.20.1662671862950; Thu, 08 Sep 2022 14:17:42 -0700 (PDT) Received: from localhost.localdomain (c-98-35-249-89.hsd1.ca.comcast.net. [98.35.249.89]) by smtp.gmail.com with ESMTPSA id pi10-20020a17090b1e4a00b00200de8ebc2bsm2306168pjb.13.2022.09.08.14.17.42 (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Thu, 08 Sep 2022 14:17:42 -0700 (PDT) From: "Yichun Zhang (agentzh)" To: linux-fsdevel@vger.kernel.org Cc: "Yichun Zhang (agentzh)" , Colin Ian King , Andrew Morton , Jens Axboe , linux-kernel@vger.kernel.org Subject: [PATCH] relay: replay_file_open(): NULL ptr deref in CPU hotplugs Date: Thu, 8 Sep 2022 14:17:30 -0700 Message-Id: <20220908211731.11534-1-yichun@openresty.com> X-Mailer: git-send-email 2.17.2 Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" CPU hotplug may introduce race conditions. We reproduced kernel panics due to this NULL ptr deref error when doing frequent random CPU hotplugs in a KVM guest. Signed-off-by: Yichun Zhang (agentzh) --- kernel/relay.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/kernel/relay.c b/kernel/relay.c index 6a611e779e95..2db69fd527d1 100644 --- a/kernel/relay.c +++ b/kernel/relay.c @@ -816,6 +816,9 @@ EXPORT_SYMBOL_GPL(relay_flush); static int relay_file_open(struct inode *inode, struct file *filp) { struct rchan_buf *buf =3D inode->i_private; + if (unlikely(buf =3D=3D NULL)) + return -ENOENT; + kref_get(&buf->kref); filp->private_data =3D buf; =20 --=20 2.17.2