| Message ID | tencent_11194B111B6F25CEBA5FBB71336B9E9D1B08@qq.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | mm/pagemap: fix null ptr deref in do_pagemap_cmd | expand |
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c index 3f78ebbb795f..ab28666956d0 100644 --- a/fs/proc/task_mmu.c +++ b/fs/proc/task_mmu.c @@ -2510,6 +2510,8 @@ static long do_pagemap_cmd(struct file *file, unsigned int cmd, switch (cmd) { case PAGEMAP_SCAN: + if (!mm) + return -EINVAL; return do_pagemap_scan(mm, arg); default:
When pagemap_open() runs in the kernel thread context, task->mm is NULL, it will causes the pagemap file object's file->private_date to be NULL when the pagemap file is opened, this will ultimately result in do_pagemap_cmd() referencing a null pointer. So, before PAGEMAP_SCAN ioctl() call do_pagemap_scan(), need check mm first. Fixes: 52526ca7fdb9 ("fs/proc/task_mmu: implement IOCTL to get and optionally clear info about PTEs") Reported-and-tested-by: syzbot+02e64be5307d72e9c309@syzkaller.appspotmail.com Signed-off-by: Edward Adam Davis <eadavis@qq.com> --- fs/proc/task_mmu.c | 2 ++ 1 file changed, 2 insertions(+)