From nobody Mon Dec 1 21:30:44 2025 Received: from mail-pl1-f201.google.com (mail-pl1-f201.google.com [209.85.214.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4B5FD30FC1D for ; Thu, 27 Nov 2025 20:16:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764274583; cv=none; b=baNzccJnd31gA8YGXa1//N0J+XWxMarABVmNpLrPyKqsDSPwnKOqSuYdleRY6yFbB3NADYF1J0GgcIRK+aWGby4uhWbDYfBITRhtfKQCQjycRl6wDp9be1C+l/Ec0DF8Axx8d06SvIvbwWj7+JlCyd5m1Dk8ck4zdfWBpgRkfN4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764274583; c=relaxed/simple; bh=RuStPMzzMAcBsN0dVzMXva8X7y+MX0+S9tP6GR5UnlI=; h=Date:Mime-Version:Message-ID:Subject:From:To:Cc:Content-Type; b=kuoGvZgDviDdj+6ZErLh2n7q125t7cQWAsuJHcQdpc9bLDh9nWk/JhYDItGxQupcu0hSsXFmZ4uMGReSEgWOd8WhHHRIzGARNUTH7OaSyWuh8oOK09Y5qCIjSlazYnaZqIRz1oCuWpqUCdxFubBqq5GPGvl4XFkLcTZMTHrSZoE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--kuniyu.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=svG/114H; arc=none smtp.client-ip=209.85.214.201 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--kuniyu.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="svG/114H" Received: by mail-pl1-f201.google.com with SMTP id d9443c01a7336-295595cd102so18265355ad.3 for ; Thu, 27 Nov 2025 12:16:22 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1764274581; x=1764879381; darn=vger.kernel.org; h=cc:to:from:subject:message-id:mime-version:date:from:to:cc:subject :date:message-id:reply-to; bh=PzA2hWCLFb6HsHvCRAMBT0nuurbeyN6o+QjR7DzipWU=; b=svG/114HAf4OOTFCA9XGgi2CbhOk3DB2IkPlPCJHWU26WjxV3DzoAGmP+PSX2j1p+C FvXmRfTIa2h4V8JytoUyFm0qYYA7yjajlIuwi/d5Dsgiw3jWH/aNi833h+m44A0pRKIg +VYkoGFfBMun8X3iYvud+yt2bH3E6C25bmQczrBlrUy7Mp7sDqy4LPJUz5SdMKmrbTul Ps0S7KbWq+UqgaP1v8WWA12jcgVUrBFROLVl8o4G2Az3ud8uwYJHsC71+V8R9GeCH16l U3qOtglSszI00NBPF55XrTFi8h8000oCz8XYiGtocQux/tVCD611STsW21bmLWMIt+NV WvPA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1764274581; x=1764879381; h=cc:to:from:subject:message-id:mime-version:date:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=PzA2hWCLFb6HsHvCRAMBT0nuurbeyN6o+QjR7DzipWU=; b=EA8dWbufl+ZJcaf3GK5Nu1PH2QeQFakbilfw7v+/LplolC6bPn4HQz/K3GPq+HebM9 b7uqyP9BdZMLtEdTjN9QHMWYiGYgdhdREN8punY1g5wLV6KygpjbqxkBUuh8z5P6SCcI dUUwLu4vEzCTXu4LK8M5LgPuhQneyXHAlH3vSWsAGjNZC1tYVzHfqYAxPVxzOkcBmtoX O6GIQefi/2kXHp12M2LNAvgSOUAgK/i2FKOLOb8iJx3JasiCt2GT/0NoE/+tf2x9XL7Q fpE6J7FImANtoQ+jA/Hx9lAAujekZCbUjbSCLpvvbbKmAu9LC2iou1l/rGZZ5CoYkjYM WEyA== X-Forwarded-Encrypted: i=1; AJvYcCV3z/6yNDMnDsNwcaaDtlOyQ4Zh8Pkd5EvS/V+jtGxsQXqTMCH1prkJsHjp5g3gsySyn+ebuz5L1cJLz4U=@vger.kernel.org X-Gm-Message-State: AOJu0Yye6Bx1fXzBG7aibEiKIp5vsXKBDIr0LGVDLXAVN8iuGgvCwZe8 HFDCL6o3mHlWbsu7NzqoYCzCdixlz+Xa1VqykJsGje9/0OV6xcogZ5o2KxFgw+VTxuC+d8JKACi o641luQ== X-Google-Smtp-Source: AGHT+IG3yNDu4mOkcC2Fdkmw/uYC6OA9aWi1AaaEkz3b+cSzWrXrsLGKYhCBeqEjxc+suTqKYHDDZEHWo5E= X-Received: from pgi128.prod.google.com ([2002:a63:886:0:b0:bd9:a349:94b0]) (user=kuniyu job=prod-delivery.src-stubby-dispatcher) by 2002:a17:903:2343:b0:294:ec7d:969c with SMTP id d9443c01a7336-29b6bf5d616mr283107625ad.49.1764274581541; Thu, 27 Nov 2025 12:16:21 -0800 (PST) Date: Thu, 27 Nov 2025 20:16:15 +0000 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 X-Mailer: git-send-email 2.52.0.158.g65b55ccf14-goog Message-ID: <20251127201618.2115275-1-kuniyu@google.com> Subject: [PATCH] fanotify: Don't call fsnotify_destroy_group() when fsnotify_alloc_group() fails. From: Kuniyuki Iwashima To: Christian Brauner , Jan Kara Cc: Amir Goldstein , Matthew Bobrowski , Kuniyuki Iwashima , Kuniyuki Iwashima , linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, syzbot+321168dfa622eda99689@syzkaller.appspotmail.com Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" syzbot reported the splat in __do_sys_fanotify_init(). [0] The cited commit introduced the fsnotify_group class. The constructor is fsnotify_alloc_group() and could fail, so the error is handled this way: CLASS(fsnotify_group, group)(&fanotify_fsnotify_ops, FSNOTIFY_GROUP_USER); if (IS_ERR(group)) return PTR_ERR(group); Even we return from the path, the destructor is triggered, and the condition does not take IS_ERR() into account. if (_T) fsnotify_destroy_group(_T), Thus, fsnotify_destroy_group() could be called for ERR_PTR(). Let's fix the condition to !IS_ERR_OR_NULL(_T). [0]: Oops: general protection fault, probably for non-canonical address 0xdffffc= 0000000003: 0000 [#1] SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f] CPU: 1 UID: 0 PID: 6016 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(ful= l) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Goo= gle 10/25/2025 RIP: 0010:kasan_byte_accessible+0x12/0x30 mm/kasan/generic.c:210 Code: 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 = 90 0f 1f 40 d6 48 c1 ef 03 48 b8 00 00 00 00 00 fc ff df <0f> b6 04 07 3c 0= 8 0f 92 c0 e9 40 01 33 09 cc 66 66 66 66 66 66 2e RSP: 0018:ffffc90003147c10 EFLAGS: 00010207 RAX: dffffc0000000000 RBX: ffffffff8b5a8b4e RCX: 707d8ea8101f1b00 RDX: 0000000000000000 RSI: ffffffff8b5a8b4e RDI: 0000000000000003 RBP: ffffffff824e37fd R08: 0000000000000001 R09: 0000000000000000 R10: dffffc0000000000 R11: fffffbfff1c0c6f3 R12: 0000000000000000 R13: 000000000000001c R14: 000000000000001c R15: 0000000000000001 FS: 000055556de07500(0000) GS:ffff888125f8b000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f09c332b5a0 CR3: 00000000750b0000 CR4: 00000000003526f0 Call Trace: __kasan_check_byte+0x12/0x40 mm/kasan/common.c:572 kasan_check_byte include/linux/kasan.h:401 [inline] lock_acquire+0x84/0x340 kernel/locking/lockdep.c:5842 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154 spin_lock include/linux/spinlock.h:351 [inline] fsnotify_group_stop_queueing fs/notify/group.c:39 [inline] fsnotify_destroy_group+0x8d/0x320 fs/notify/group.c:58 class_fsnotify_group_destructor fs/notify/fanotify/fanotify_user.c:1600 [i= nline] __do_sys_fanotify_init fs/notify/fanotify/fanotify_user.c:1759 [inline] __se_sys_fanotify_init+0x991/0xbc0 fs/notify/fanotify/fanotify_user.c:1607 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f09c338f749 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 = 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff f= f 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffd8b6be3e8 EFLAGS: 00000246 ORIG_RAX: 000000000000012c RAX: ffffffffffffffda RBX: 00007f09c35e5fa0 RCX: 00007f09c338f749 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000f00 RBP: 00007ffd8b6be440 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 R13: 00007f09c35e5fa0 R14: 00007f09c35e5fa0 R15: 0000000000000002 Modules linked in: Fixes: 3a6b564a6beb ("fanotify: convert fanotify_init() to FD_PREPARE()") Reported-by: syzbot+321168dfa622eda99689@syzkaller.appspotmail.com Closes: https://lore.kernel.org/lkml/6928b121.a70a0220.d98e3.0110.GAE@googl= e.com/ Signed-off-by: Kuniyuki Iwashima Reviewed-by: Jan Kara --- fs/notify/fanotify/fanotify_user.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/fs/notify/fanotify/fanotify_user.c b/fs/notify/fanotify/fanoti= fy_user.c index be0a96ad4316..d0b9b984002f 100644 --- a/fs/notify/fanotify/fanotify_user.c +++ b/fs/notify/fanotify/fanotify_user.c @@ -1598,10 +1598,10 @@ static struct hlist_head *fanotify_alloc_merge_hash= (void) } =20 DEFINE_CLASS(fsnotify_group, - struct fsnotify_group *, - if (_T) fsnotify_destroy_group(_T), - fsnotify_alloc_group(ops, flags), - const struct fsnotify_ops *ops, int flags) + struct fsnotify_group *, + if (!IS_ERR_OR_NULL(_T)) fsnotify_destroy_group(_T), + fsnotify_alloc_group(ops, flags), + const struct fsnotify_ops *ops, int flags) =20 /* fanotify syscalls */ SYSCALL_DEFINE2(fanotify_init, unsigned int, flags, unsigned int, event_f_= flags) --=20 2.52.0.158.g65b55ccf14-goog