fs/fuse/file.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
syzbot reported a null-ptr-deref in fuse_read_args_fill. [1]
About this case, calltrace is:
erofs_read_superblock()->
erofs_read_metabuf()->
erofs_bread()->
read_mapping_folio()->
do_read_cache_folio()->
filemap_read_folio()->
fuse_read_folio()->
fuse_do_readpage()->
fuse_read_args_fill()
erofs_bread() calls read_mapping_folio() passing NULL file, which causes a
NULL pointer dereference in fuse_read_args_fill.
To avoid this issue, need to add a check for file in fuse_read_folio().
[1]
KASAN: null-ptr-deref in range [0x0000000000000060-0x0000000000000067]
CPU: 3 UID: 0 PID: 5947 Comm: syz-executor314 Not tainted 6.12.0-rc5-syzkaller-00044-gc1e939a21eb1 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:fuse_read_args_fill fs/fuse/file.c:631 [inline]
RIP: 0010:fuse_do_readpage+0x276/0x640 fs/fuse/file.c:880
Code: e8 9f c7 91 fe 8b 44 24 10 89 44 24 78 41 89 c4 e8 8f c7 91 fe 48 8d 7b 60 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 1d 03 00 00 48 b8 00 00 00 00 00 fc ff df 48 8b
RSP: 0018:ffffc90006a0f820 EFLAGS: 00010206
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff82fbb4c9
RDX: 000000000000000c RSI: ffffffff82fbb4f1 RDI: 0000000000000060
RBP: 0000000000000000 R08: 0000000000000007 R09: 7fffffffffffffff
R10: 0000000000000fff R11: ffffffff961d4b88 R12: 0000000000001000
R13: ffff8880382b8000 R14: ffff888025153780 R15: ffffc90006a0f8b8
FS: 00007f7583f3d6c0(0000) GS:ffff88806a900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020000240 CR3: 0000000030d30000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
fuse_read_folio+0xb0/0x100 fs/fuse/file.c:905
filemap_read_folio+0xc6/0x2a0 mm/filemap.c:2367
do_read_cache_folio+0x263/0x5c0 mm/filemap.c:3825
read_mapping_folio include/linux/pagemap.h:1011 [inline]
erofs_bread+0x34d/0x7e0 fs/erofs/data.c:41
erofs_read_superblock fs/erofs/super.c:281 [inline]
erofs_fc_fill_super+0x2b9/0x2500 fs/erofs/super.c:625
vfs_get_super fs/super.c:1280 [inline]
get_tree_nodev+0xda/0x190 fs/super.c:1299
erofs_fc_get_tree+0x1fe/0x2e0 fs/erofs/super.c:723
vfs_get_tree+0x8f/0x380 fs/super.c:1800
do_new_mount fs/namespace.c:3507 [inline]
path_mount+0x14e6/0x1f20 fs/namespace.c:3834
do_mount fs/namespace.c:3847 [inline]
__do_sys_mount fs/namespace.c:4057 [inline]
__se_sys_mount fs/namespace.c:4034 [inline]
__x64_sys_mount+0x294/0x320 fs/namespace.c:4034
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Reported-and-tested-by: syzbot+0b1279812c46e48bb0c1@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=0b1279812c46e48bb0c1
Signed-off-by: Lizhi Xu <lizhi.xu@windriver.com>
---
fs/fuse/file.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index dafdf766b1d5..5ce37d1f617c 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -899,7 +899,7 @@ static int fuse_read_folio(struct file *file, struct folio *folio)
int err;
err = -EIO;
- if (fuse_is_bad(inode))
+ if (fuse_is_bad(inode) || !file)
goto out;
err = fuse_do_readpage(file, page);
--
2.43.0On 2024/11/14 10:04, Lizhi Xu wrote: > syzbot reported a null-ptr-deref in fuse_read_args_fill. [1] > > About this case, calltrace is: > erofs_read_superblock()-> > erofs_read_metabuf()-> > erofs_bread()-> > read_mapping_folio()-> > do_read_cache_folio()-> > filemap_read_folio()-> > fuse_read_folio()-> > fuse_do_readpage()-> > fuse_read_args_fill() > > erofs_bread() calls read_mapping_folio() passing NULL file, which causes a > NULL pointer dereference in fuse_read_args_fill. > To avoid this issue, need to add a check for file in fuse_read_folio(). > > [1] > KASAN: null-ptr-deref in range [0x0000000000000060-0x0000000000000067] > CPU: 3 UID: 0 PID: 5947 Comm: syz-executor314 Not tainted 6.12.0-rc5-syzkaller-00044-gc1e939a21eb1 #0 > Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 > RIP: 0010:fuse_read_args_fill fs/fuse/file.c:631 [inline] > RIP: 0010:fuse_do_readpage+0x276/0x640 fs/fuse/file.c:880 > Code: e8 9f c7 91 fe 8b 44 24 10 89 44 24 78 41 89 c4 e8 8f c7 91 fe 48 8d 7b 60 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 1d 03 00 00 48 b8 00 00 00 00 00 fc ff df 48 8b > RSP: 0018:ffffc90006a0f820 EFLAGS: 00010206 > RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff82fbb4c9 > RDX: 000000000000000c RSI: ffffffff82fbb4f1 RDI: 0000000000000060 > RBP: 0000000000000000 R08: 0000000000000007 R09: 7fffffffffffffff > R10: 0000000000000fff R11: ffffffff961d4b88 R12: 0000000000001000 > R13: ffff8880382b8000 R14: ffff888025153780 R15: ffffc90006a0f8b8 > FS: 00007f7583f3d6c0(0000) GS:ffff88806a900000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 0000000020000240 CR3: 0000000030d30000 CR4: 0000000000352ef0 > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 > DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 > Call Trace: > <TASK> > fuse_read_folio+0xb0/0x100 fs/fuse/file.c:905 > filemap_read_folio+0xc6/0x2a0 mm/filemap.c:2367 > do_read_cache_folio+0x263/0x5c0 mm/filemap.c:3825 > read_mapping_folio include/linux/pagemap.h:1011 [inline] > erofs_bread+0x34d/0x7e0 fs/erofs/data.c:41 > erofs_read_superblock fs/erofs/super.c:281 [inline] > erofs_fc_fill_super+0x2b9/0x2500 fs/erofs/super.c:625 > vfs_get_super fs/super.c:1280 [inline] > get_tree_nodev+0xda/0x190 fs/super.c:1299 > erofs_fc_get_tree+0x1fe/0x2e0 fs/erofs/super.c:723 > vfs_get_tree+0x8f/0x380 fs/super.c:1800 > do_new_mount fs/namespace.c:3507 [inline] > path_mount+0x14e6/0x1f20 fs/namespace.c:3834 > do_mount fs/namespace.c:3847 [inline] > __do_sys_mount fs/namespace.c:4057 [inline] > __se_sys_mount fs/namespace.c:4034 [inline] > __x64_sys_mount+0x294/0x320 fs/namespace.c:4034 > do_syscall_x64 arch/x86/entry/common.c:52 [inline] > do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 > entry_SYSCALL_64_after_hwframe+0x77/0x7f > > Reported-and-tested-by: syzbot+0b1279812c46e48bb0c1@syzkaller.appspotmail.com > Closes: https://syzkaller.appspot.com/bug?extid=0b1279812c46e48bb0c1 > Signed-off-by: Lizhi Xu <lizhi.xu@windriver.com> Most filesystems (except for some network fses and FUSE) won't use `file` at all and as documented in https://docs.kernel.org/filesystems/vfs.html But I will pass in `file` for this issue instead in order to support use cases over FUSE, other than just bail out like this. Thanks, Gao Xiang
© 2016 - 2024 Red Hat, Inc.