From nobody Fri Oct 3 08:53:10 2025 Received: from fanzine2.igalia.com (fanzine2.igalia.com [213.97.179.56]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5047E2D77E8; Wed, 3 Sep 2025 08:35:10 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=213.97.179.56 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1756888514; cv=none; b=BGpjwO5PxRAC0YC5fQ472UWVqYnE37vYHHZCQDk39OEfwb24LCCl6EA75+azQbp7y9ZkVjn8Rg5N79rByMgWMVGvjIlEuQj/mqeF4sJAKLP/aajUEW+NwqhBBEeWnVHMqLA6XKNoNCHyxcTgwrdYV+2KWB1hySqQAP/Jg7QePzg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1756888514; c=relaxed/simple; bh=HOK2OBFehwf+Ojm351ekqU9NNngwOena2BOEdeRC/JA=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=ZQyfeeys/pC11EdC+RAw7kTOUhve6fzk/2AbkRZMdbpS0e7fgCCqYyx2LYYZqQth/QtICw6+6JMkGPWopOEiZBXKTSj/RDlrgXVCuyYhuJc/J6ZPab/emqnyPZ0aJTV46mlvCtVZaxtusmvzKDYe0i+Ca18auE4r/P0iEisQBp8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=igalia.com; spf=pass smtp.mailfrom=igalia.com; dkim=pass (2048-bit key) header.d=igalia.com header.i=@igalia.com header.b=O1d1dxvD; arc=none smtp.client-ip=213.97.179.56 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=igalia.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=igalia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=igalia.com header.i=@igalia.com header.b="O1d1dxvD" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=igalia.com; s=20170329; h=Content-Transfer-Encoding:MIME-Version:Message-ID:Date:Subject: Cc:To:From:Sender:Reply-To:Content-Type:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=xT0ARSrlOs0s7qJir2qDh4AiSKuyaQLSzIrVIFAShXI=; b=O1d1dxvD4ujW5HuVrtDdeLx8sr t85Hzzf5zrPSukGnOQD6ro/kzm7Tin/X0gD+9VffRz5pkBJt++04fvuC0CqlkIGJo+ExpIt6oK+UV lMFQuJ87DS8FQuiQ8eCLvNpJ2SZ+c2ofrckTLTCuaZRzbHDrPTAFyqNjvi+LdzpZHUbcgTgRCs1UK 7Vk0DWGQHYGJJhTvsJuxKCdEJlCn9+zuZlSi3U2eT92pjbMPAU5hgTfOdX0kYTwuUpZLM/hoHVP0B 85V/zlAtWoClOqapoN+3L580rB6rjAduNYqwVsFHgDado2jo7d/ltu0pY2IDL1oCpvo9/TmHfHFJ2 XGBdPNgg==; Received: from bl17-145-117.dsl.telepac.pt ([188.82.145.117] helo=localhost) by fanzine2.igalia.com with utf8esmtpsa (Cipher TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim) id 1utixJ-00663d-6L; Wed, 03 Sep 2025 10:35:01 +0200 From: Luis Henriques To: Miklos Szeredi , Joanne Koong Cc: linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, kernel-dev@igalia.com, Luis Henriques Subject: [PATCH v2] fuse: prevent possible NULL pointer dereference in fuse_iomap_writeback_{range,submit}() Date: Wed, 3 Sep 2025 09:34:53 +0100 Message-ID: <20250903083453.26618-1-luis@igalia.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" These two functions make use of the WARN_ON_ONCE() macro to help debugging a NULL wpc->wb_ctx. However, this doesn't prevent the possibility of NULL pointer dereferences in the code. This patch adds some extra defensive checks to avoid these NULL pointer accesses. Fixes: ef7e7cbb323f ("fuse: use iomap for writeback") Signed-off-by: Luis Henriques --- Hi! This v2 results from Joanne's inputs -- I now believe that it is better to keep the WARN_ON_ONCE() macros, but it's still good to try to minimise the undesirable effects of a NULL wpc->wb_ctx. I've also added the 'Fixes:' tag to the commit message. fs/fuse/file.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/fs/fuse/file.c b/fs/fuse/file.c index 5525a4520b0f..990c287bc3e3 100644 --- a/fs/fuse/file.c +++ b/fs/fuse/file.c @@ -2135,14 +2135,18 @@ static ssize_t fuse_iomap_writeback_range(struct io= map_writepage_ctx *wpc, unsigned len, u64 end_pos) { struct fuse_fill_wb_data *data =3D wpc->wb_ctx; - struct fuse_writepage_args *wpa =3D data->wpa; - struct fuse_args_pages *ap =3D &wpa->ia.ap; + struct fuse_writepage_args *wpa; + struct fuse_args_pages *ap; struct inode *inode =3D wpc->inode; struct fuse_inode *fi =3D get_fuse_inode(inode); struct fuse_conn *fc =3D get_fuse_conn(inode); loff_t offset =3D offset_in_folio(folio, pos); =20 - WARN_ON_ONCE(!data); + if (WARN_ON_ONCE(!data)) + return -EIO; + + wpa =3D data->wpa; + ap =3D &wpa->ia.ap; =20 if (!data->ff) { data->ff =3D fuse_write_file_get(fi); @@ -2182,7 +2186,8 @@ static int fuse_iomap_writeback_submit(struct iomap_w= ritepage_ctx *wpc, { struct fuse_fill_wb_data *data =3D wpc->wb_ctx; =20 - WARN_ON_ONCE(!data); + if (WARN_ON_ONCE(!data)) + return error ? error : -EIO; =20 if (data->wpa) { WARN_ON(!data->wpa->ia.ap.num_folios);