xfs: handle NULL b_addr in xfs_buf_free

[PATCH] xfs: handle NULL b_addr in xfs_buf_free

Posted by Yun Zhou 5 days, 12 hours ago

When xfs_buf_alloc_backing_mem() fails, xfs_buf_free() is called with
bp->b_addr still NULL.  The code falls through to the folio_put path
which calls virt_to_folio(NULL), dereferencing an invalid address and
causing a kernel crash.

 Call Trace:
  xfs_buf_free+0x25f/0x510
  xfs_buf_alloc+0xc98/0x19b0
  xfs_buf_find_insert+0x55/0x14d0
  xfs_buf_get_map+0x122b/0x17c0
  xfbtree_init_leaf_block+0x11c/0x4a0
  xfbtree_init+0x1bb/0x460
  xrep_rmap_setup_scan+0x100/0x1f0
  xrep_rmapbt+0x41/0xc0

Fix this by skipping folio_put() when bp->b_addr is NULL.

Fixes: 5076a6040ca1 ("xfs: support in-memory buffer cache targets")
Reported-by: syzbot+94c22d92f72f5a235b7d@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=94c22d92f72f5a235b7d
Signed-off-by: Yun Zhou <yun.zhou@windriver.com>
---
 fs/xfs/xfs_buf.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/xfs/xfs_buf.c b/fs/xfs/xfs_buf.c
index e1465e950acc..48d7dfd3e15f 100644
--- a/fs/xfs/xfs_buf.c
+++ b/fs/xfs/xfs_buf.c
@@ -114,7 +114,7 @@ xfs_buf_free(
 		vfree(bp->b_addr);
 	else if (bp->b_flags & _XBF_KMEM)
 		kfree(bp->b_addr);
-	else
+	else if (bp->b_addr)
 		folio_put(virt_to_folio(bp->b_addr));
 
 	call_rcu(&bp->b_rcu, xfs_buf_free_callback);
-- 
2.43.0

Re: [PATCH] xfs: handle NULL b_addr in xfs_buf_free

Posted by Carlos Maiolino 3 days, 16 hours ago

On Sun, 19 Jul 2026 23:11:24 +0800, Yun Zhou wrote:
> When xfs_buf_alloc_backing_mem() fails, xfs_buf_free() is called with
> bp->b_addr still NULL.  The code falls through to the folio_put path
> which calls virt_to_folio(NULL), dereferencing an invalid address and
> causing a kernel crash.
> 
>  Call Trace:
>   xfs_buf_free+0x25f/0x510
>   xfs_buf_alloc+0xc98/0x19b0
>   xfs_buf_find_insert+0x55/0x14d0
>   xfs_buf_get_map+0x122b/0x17c0
>   xfbtree_init_leaf_block+0x11c/0x4a0
>   xfbtree_init+0x1bb/0x460
>   xrep_rmap_setup_scan+0x100/0x1f0
>   xrep_rmapbt+0x41/0xc0
> 
> [...]

Applied to for-next, thanks!

[1/1] xfs: handle NULL b_addr in xfs_buf_free
      commit: 2ba9288085f15d2eec21cdafe438a9d03f44737a

Best regards,
-- 
Carlos Maiolino <cem@kernel.org>

Re: [PATCH] xfs: handle NULL b_addr in xfs_buf_free

Posted by Christoph Hellwig 4 days, 19 hours ago

On Sun, Jul 19, 2026 at 11:11:24PM +0800, Yun Zhou wrote:
> When xfs_buf_alloc_backing_mem() fails, xfs_buf_free() is called with
> bp->b_addr still NULL.  The code falls through to the folio_put path
> which calls virt_to_folio(NULL), dereferencing an invalid address and
> causing a kernel crash.

Looks good:

Reviewed-by: Christoph Hellwig <hch@lst.de>