| Message ID | 20220411113145.797121-1-r33s3n6@gmail.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | fs: xfs: fix possible NULL pointer dereference in xfs_rw_bdev() | expand |
On Mon, Apr 11, 2022 at 07:31:45PM +0800, Zixuan Fu wrote: > In our fault-injection testing, bio_alloc() may fail with low memory and > return NULL. Well, in that case your fault injection seems to be completely broken. Please take a closer look at how bio_alloc is implemented and documented.
diff --git a/fs/xfs/xfs_bio_io.c b/fs/xfs/xfs_bio_io.c index ae4345b37621..37887029a6c7 100644 --- a/fs/xfs/xfs_bio_io.c +++ b/fs/xfs/xfs_bio_io.c @@ -28,6 +28,8 @@ xfs_rw_bdev( bio = bio_alloc(bdev, bio_max_vecs(left), op | REQ_META | REQ_SYNC, GFP_KERNEL); + if (!bio) + return -ENOMEM; bio->bi_iter.bi_sector = sector; do {
In our fault-injection testing, bio_alloc() may fail with low memory and return NULL. In this case, the variable "bio" in xfs_rw_bdev() would be NULL and then it is dereferenced in "bio_set_dev(bio, bdev)". The failure log is listed as follows: [ 16.009947] BUG: kernel NULL pointer dereference, address: 0000000000000015 ... [ 16.012406] RIP: 0010:bio_set_dev+0x76/0x160 [xfs] ... [ 16.017773] Call Trace: [ 16.017925] <TASK> [ 16.018065] xfs_rw_bdev+0x29e/0x9f0 [xfs] [ 16.018396] ? _raw_spin_unlock_irqrestore+0x3c/0x70 [ 16.018697] xlog_do_io+0x183/0x4a0 [xfs] [ 16.019019] xlog_bwrite+0x73/0xc0 [xfs] [ 16.019333] xlog_write_log_records+0x457/0x5c0 [xfs] [ 16.019723] xlog_clear_stale_blocks+0x2d1/0x430 [xfs] [ 16.020107] xlog_find_tail+0x63d/0xb60 [xfs] [ 16.020447] xlog_recover+0x77/0x650 [xfs] [ 16.021101] xfs_log_mount+0x720/0xcf0 [xfs] [ 16.021437] xfs_mountfs+0xf0c/0x2440 [xfs] [ 16.021767] xfs_fs_fill_super+0x1eaa/0x21e0 [xfs] [ 16.022132] get_tree_bdev+0x3c3/0x5f0 [ 16.022361] ? xfs_fs_warn_deprecated+0x100/0x100 [xfs] [ 16.022750] xfs_fs_get_tree+0x68/0xb0 [xfs] [ 16.023090] vfs_get_tree+0x81/0x220 [ 16.023308] path_mount+0x1061/0x2340 [ 16.023532] ? kasan_quarantine_put+0x2c/0x1a0 [ 16.023804] ? slab_free_freelist_hook+0xde/0x160 [ 16.024087] ? mark_mounts_for_expiry+0x410/0x410 [ 16.024370] ? user_path_at_empty+0xf6/0x160 [ 16.024629] ? kmem_cache_free+0xb8/0x1a0 [ 16.024876] ? user_path_at_empty+0xf6/0x160 [ 16.025134] __se_sys_mount+0x217/0x2b0 [ 16.025367] ? __x64_sys_mount+0xd0/0xd0 [ 16.025605] ? exit_to_user_mode_prepare+0x32/0x130 [ 16.025899] do_syscall_64+0x41/0x90 [ 16.026116] entry_SYSCALL_64_after_hwframe+0x44/0xae ... [ 16.030310] </TASK> This patch adds a NULL check of "bio" and return -ENOMEM if it's NULL. Reported-by: TOTE Robot <oslab@tsinghua.edu.cn> Signed-off-by: Zixuan Fu <r33s3n6@gmail.com> --- fs/xfs/xfs_bio_io.c | 2 ++ 1 file changed, 2 insertions(+)