| Message ID | 20240716022518.430237-1-make24@iscas.ac.cn (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | filemap: fix error pointer dereference in filemap_fault() | expand |
On Tue, Jul 16, 2024 at 10:25:18AM +0800, Ma Ke wrote: > This code calls folio_put() on an error pointer which will lead to a > crash. Check for both error pointers and NULL pointers before calling > folio_put(). Have you observed this, or do you just think this can happen? If the former, please share the crash. If the latter, please document the path which can lead to this happening. > Fixes: 38a55db9877c ("filemap: Handle error return from __filemap_get_folio()") > Signed-off-by: Ma Ke <make24@iscas.ac.cn> > --- > mm/filemap.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/mm/filemap.c b/mm/filemap.c > index 657bcd887fdb..cd26617d8987 100644 > --- a/mm/filemap.c > +++ b/mm/filemap.c > @@ -3420,7 +3420,7 @@ vm_fault_t filemap_fault(struct vm_fault *vmf) > * re-find the vma and come back and find our hopefully still populated > * page. > */ > - if (!IS_ERR(folio)) > + if (!IS_ERR_OR_NULL(folio)) > folio_put(folio); > if (mapping_locked) > filemap_invalidate_unlock_shared(mapping); > -- > 2.25.1 >
diff --git a/mm/filemap.c b/mm/filemap.c index 657bcd887fdb..cd26617d8987 100644 --- a/mm/filemap.c +++ b/mm/filemap.c @@ -3420,7 +3420,7 @@ vm_fault_t filemap_fault(struct vm_fault *vmf) * re-find the vma and come back and find our hopefully still populated * page. */ - if (!IS_ERR(folio)) + if (!IS_ERR_OR_NULL(folio)) folio_put(folio); if (mapping_locked) filemap_invalidate_unlock_shared(mapping);
This code calls folio_put() on an error pointer which will lead to a crash. Check for both error pointers and NULL pointers before calling folio_put(). Fixes: 38a55db9877c ("filemap: Handle error return from __filemap_get_folio()") Signed-off-by: Ma Ke <make24@iscas.ac.cn> --- mm/filemap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)