Syzbot reported a null-ptr-deref in bfs_move_block.
sb_getblk() can fail, so need to check its return value.
If returned buffer head is not uptodate, it is considered corrupt.
Reported-and-tested-by: syzbot+f51a2a34984e4d8888fd@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=f51a2a34984e4d8888fd
Signed-off-by: Edward Adam Davis <eadavis@qq.com>
---
fs/bfs/file.c | 14 +++++++++++++-
1 file changed, 13 insertions(+), 1 deletion(-)
diff --git a/fs/bfs/file.c b/fs/bfs/file.c
index fa66a09e496a..983cc191d1e3 100644
--- a/fs/bfs/file.c
+++ b/fs/bfs/file.c
@@ -35,16 +35,28 @@ static int bfs_move_block(unsigned long from, unsigned long to,
struct super_block *sb)
{
struct buffer_head *bh, *new;
+ int err = 0;
bh = sb_bread(sb, from);
if (!bh)
return -EIO;
new = sb_getblk(sb, to);
+ if (!new) {
+ bforget(bh);
+ return -ENOMEM;
+ }
+
+ if (!buffer_uptodate(new)) {
+ err = -EIO;
+ goto out;
+ }
+
memcpy(new->b_data, bh->b_data, bh->b_size);
mark_buffer_dirty(new);
+out:
bforget(bh);
brelse(new);
- return 0;
+ return err;
}
static int bfs_move_blocks(struct super_block *sb, unsigned long start,
--
2.43.0