From patchwork Tue Dec 13 08:11:03 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jun Nie X-Patchwork-Id: 13071773 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9B0FDC4332F for ; Tue, 13 Dec 2022 08:11:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234724AbiLMILe (ORCPT ); Tue, 13 Dec 2022 03:11:34 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37532 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233694AbiLMILN (ORCPT ); Tue, 13 Dec 2022 03:11:13 -0500 Received: from mail-pj1-x1036.google.com (mail-pj1-x1036.google.com [IPv6:2607:f8b0:4864:20::1036]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C1D8D17581 for ; Tue, 13 Dec 2022 00:11:12 -0800 (PST) Received: by mail-pj1-x1036.google.com with SMTP id k88-20020a17090a4ce100b00219d0b857bcso2744490pjh.1 for ; Tue, 13 Dec 2022 00:11:12 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=content-transfer-encoding:mime-version:message-id:date:subject:to :from:from:to:cc:subject:date:message-id:reply-to; bh=LdixbUsDgZBRFhhWcpEMBV8T7dpZCUPI7rjUYbSLzrM=; b=udcno0lDcEMVMXQpTnhDi/Iy/Bnh+y+OyDrCwV/6DKlKH/rDyWjlhUElau3iKhH9gc iLXIP1e+JK+6T3aI+Z5doWUSOiwMAIMj8kIAc8wSJzw8DsjbnHJhPZtaQ7pnH0III6z9 8isv63T3WDzVyOYEZBiY0B+/knY2IQREMpo4MYikJc2BxXtGulXDOLbPQU51EzYdy+UM HhYDCSEfnQ5q1j8wbx6MBB78q5HsirhWKOHmB1o0e6Hm1iVpW2ir+DxNEDxls/vP6Ptt 7+Hf+4cJQ20dK10UViRSN9xhQt3TryrXvWWbJsYEubrszJ7ZiVTcTKWmclgCmygNsjK8 4XUg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:message-id:date:subject:to :from:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=LdixbUsDgZBRFhhWcpEMBV8T7dpZCUPI7rjUYbSLzrM=; b=61n6YsBQx97a+t2gC6q8OJt4RZMaYH2mYi0b9HjF7MruVsM6NEQ42Z0CMsvO+90M5C HPVFvYoGWRi6wbEkJsWZcCS4XlYDkV6lGBKULTDjRPcv9ukRJXUGuAYY579Je4S5+xxZ Xj2gOkCV+tqmUClVEhnTFxOgYSz+Y+PKyE0aotOVWZ/4GJ2KsJ7lvy6iLlDtUny0rp/k ymXPBiYk6kIuIzt1io3rahGAHsU0wyLN3szu+eeJt26ibIVjXa09KjXRA+ZZkfbwuPki jMFwkxig2n/k34JU8MR/vps9bpjiZMr88pu7qvlziuelzxKDQhA3jcHDTq3nyjit3Hhz Mn5w== X-Gm-Message-State: ANoB5plSLd96bRrhj1CnwTjRXbENW/O+hKFCYP9V/BoKkawM0y6aq9j7 83Q5lQui166weNf9ddsVUiOFpg== X-Google-Smtp-Source: AA0mqf5Ta1p1en6UFwTxcEdNJFP03V1wR+0fMQiNUSSbVS6Z/nSmWTedseocX/UQj6mYupQ3CAkGBA== X-Received: by 2002:a17:90b:198e:b0:219:cb6d:7b0b with SMTP id mv14-20020a17090b198e00b00219cb6d7b0bmr19147590pjb.44.1670919072227; Tue, 13 Dec 2022 00:11:12 -0800 (PST) Received: from niej-dt-7B47.. (80.251.214.228.16clouds.com. [80.251.214.228]) by smtp.gmail.com with ESMTPSA id m6-20020a17090a34c600b00219025945dcsm6747757pjf.19.2022.12.13.00.11.07 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 13 Dec 2022 00:11:11 -0800 (PST) From: Jun Nie To: tytso@mit.edu, jaegeuk@kernel.org, ebiggers@kernel.org, linux-fscrypt@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH] fscrypt: Fix null pointer when defer i_crypt_info Date: Tue, 13 Dec 2022 16:11:03 +0800 Message-Id: <20221213081103.2182231-1-jun.nie@linaro.org> X-Mailer: git-send-email 2.34.1 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-fscrypt@vger.kernel.org syzbot report below bug[1]. Fix it with checking null pointer before deferring i_crypt_info. [1] general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] CPU: 3 PID: 456 Comm: repro Not tainted 6.1.0+gc0daf896 #169 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 RIP: 0010:fscrypt_limit_io_blocks+0xfa/0x2c0 Call Trace: ext4_iomap_begin+0x6c5/0x7e0 ? asym_cpu_capacity_scan+0x6b0/0x6b0 ? ext4_iomap_begin_report+0x6b0/0x6b0 ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 ? ext4_commit_super+0x3c1/0x560 ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 ? ext4_handle_error+0x3bf/0x6b0 ? ext4_iomap_begin_report+0x6b0/0x6b0 iomap_iter+0x538/0xc80 iomap_bmap+0x1ed/0x2d0 ? iomap_to_fiemap+0x220/0x220 ? rwsem_down_read_slowpath+0xc00/0xc00 ? __ext4_iget+0x19c/0x4370 ext4_bmap+0x288/0x470 ? mpage_prepare_extent_to_map+0xd80/0xd80 bmap+0xb1/0x120 jbd2_journal_init_inode+0x7d/0x3f0 ? up_write+0x6c/0xb0 ? jbd2_journal_init_dev+0x130/0x130 ? register_shrinker+0x33/0x160 ext4_fill_super+0xa467/0xc650 ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 ? ext4_reconfigure+0x2ad0/0x2ad0 ? snprintf+0xbb/0xf0 ? vsprintf+0x40/0x40 ? up_write+0x6c/0xb0 ? __sanitizer_cov_trace_cmp4+0x16/0x20 ? set_blocksize+0x2f0/0x380 get_tree_bdev+0x438/0x740 ? get_tree_bdev+0x438/0x740 ? ext4_reconfigure+0x2ad0/0x2ad0 ext4_get_tree+0x1d/0x30 vfs_get_tree+0x88/0x2e0 path_mount+0x6ca/0x1ec0 ? putname+0x110/0x150 ? finish_automount+0x790/0x790 ? putname+0x115/0x150 __x64_sys_mount+0x2aa/0x340 ? copy_mnt_ns+0xab0/0xab0 ? __sanitizer_cov_trace_cmp4+0x16/0x20 ? exit_to_user_mode_prepare+0x40/0x120 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Fixes: 5fee36095cda ("fscrypt: add inline encryption support") Reported-by: syzbot+ba9dac45bc76c490b7c3@syzkaller.appspotmail.com Signed-off-by: Jun Nie --- fs/crypto/inline_crypt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/crypto/inline_crypt.c b/fs/crypto/inline_crypt.c index cea8b14007e6..fec859e83774 100644 --- a/fs/crypto/inline_crypt.c +++ b/fs/crypto/inline_crypt.c @@ -232,7 +232,7 @@ void fscrypt_destroy_inline_crypt_key(struct super_block *sb, bool __fscrypt_inode_uses_inline_crypto(const struct inode *inode) { - return inode->i_crypt_info->ci_inlinecrypt; + return inode->i_crypt_info && inode->i_crypt_info->ci_inlinecrypt; } EXPORT_SYMBOL_GPL(__fscrypt_inode_uses_inline_crypto);