| Message ID | 20241114020417.3524632-1-lizhi.xu@windriver.com (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | fuse: check file before running readpage | expand |
On 2024/11/14 10:04, Lizhi Xu wrote: > syzbot reported a null-ptr-deref in fuse_read_args_fill. [1] > > About this case, calltrace is: > erofs_read_superblock()-> > erofs_read_metabuf()-> > erofs_bread()-> > read_mapping_folio()-> > do_read_cache_folio()-> > filemap_read_folio()-> > fuse_read_folio()-> > fuse_do_readpage()-> > fuse_read_args_fill() > > erofs_bread() calls read_mapping_folio() passing NULL file, which causes a > NULL pointer dereference in fuse_read_args_fill. > To avoid this issue, need to add a check for file in fuse_read_folio(). > > [1] > KASAN: null-ptr-deref in range [0x0000000000000060-0x0000000000000067] > CPU: 3 UID: 0 PID: 5947 Comm: syz-executor314 Not tainted 6.12.0-rc5-syzkaller-00044-gc1e939a21eb1 #0 > Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 > RIP: 0010:fuse_read_args_fill fs/fuse/file.c:631 [inline] > RIP: 0010:fuse_do_readpage+0x276/0x640 fs/fuse/file.c:880 > Code: e8 9f c7 91 fe 8b 44 24 10 89 44 24 78 41 89 c4 e8 8f c7 91 fe 48 8d 7b 60 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 1d 03 00 00 48 b8 00 00 00 00 00 fc ff df 48 8b > RSP: 0018:ffffc90006a0f820 EFLAGS: 00010206 > RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff82fbb4c9 > RDX: 000000000000000c RSI: ffffffff82fbb4f1 RDI: 0000000000000060 > RBP: 0000000000000000 R08: 0000000000000007 R09: 7fffffffffffffff > R10: 0000000000000fff R11: ffffffff961d4b88 R12: 0000000000001000 > R13: ffff8880382b8000 R14: ffff888025153780 R15: ffffc90006a0f8b8 > FS: 00007f7583f3d6c0(0000) GS:ffff88806a900000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 0000000020000240 CR3: 0000000030d30000 CR4: 0000000000352ef0 > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 > DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 > Call Trace: > <TASK> > fuse_read_folio+0xb0/0x100 fs/fuse/file.c:905 > filemap_read_folio+0xc6/0x2a0 mm/filemap.c:2367 > do_read_cache_folio+0x263/0x5c0 mm/filemap.c:3825 > read_mapping_folio include/linux/pagemap.h:1011 [inline] > erofs_bread+0x34d/0x7e0 fs/erofs/data.c:41 > erofs_read_superblock fs/erofs/super.c:281 [inline] > erofs_fc_fill_super+0x2b9/0x2500 fs/erofs/super.c:625 > vfs_get_super fs/super.c:1280 [inline] > get_tree_nodev+0xda/0x190 fs/super.c:1299 > erofs_fc_get_tree+0x1fe/0x2e0 fs/erofs/super.c:723 > vfs_get_tree+0x8f/0x380 fs/super.c:1800 > do_new_mount fs/namespace.c:3507 [inline] > path_mount+0x14e6/0x1f20 fs/namespace.c:3834 > do_mount fs/namespace.c:3847 [inline] > __do_sys_mount fs/namespace.c:4057 [inline] > __se_sys_mount fs/namespace.c:4034 [inline] > __x64_sys_mount+0x294/0x320 fs/namespace.c:4034 > do_syscall_x64 arch/x86/entry/common.c:52 [inline] > do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 > entry_SYSCALL_64_after_hwframe+0x77/0x7f > > Reported-and-tested-by: syzbot+0b1279812c46e48bb0c1@syzkaller.appspotmail.com > Closes: https://syzkaller.appspot.com/bug?extid=0b1279812c46e48bb0c1 > Signed-off-by: Lizhi Xu <lizhi.xu@windriver.com> Most filesystems (except for some network fses and FUSE) won't use `file` at all and as documented in https://docs.kernel.org/filesystems/vfs.html But I will pass in `file` for this issue instead in order to support use cases over FUSE, other than just bail out like this. Thanks, Gao Xiang
diff --git a/fs/fuse/file.c b/fs/fuse/file.c index dafdf766b1d5..5ce37d1f617c 100644 --- a/fs/fuse/file.c +++ b/fs/fuse/file.c @@ -899,7 +899,7 @@ static int fuse_read_folio(struct file *file, struct folio *folio) int err; err = -EIO; - if (fuse_is_bad(inode)) + if (fuse_is_bad(inode) || !file) goto out; err = fuse_do_readpage(file, page);
syzbot reported a null-ptr-deref in fuse_read_args_fill. [1] About this case, calltrace is: erofs_read_superblock()-> erofs_read_metabuf()-> erofs_bread()-> read_mapping_folio()-> do_read_cache_folio()-> filemap_read_folio()-> fuse_read_folio()-> fuse_do_readpage()-> fuse_read_args_fill() erofs_bread() calls read_mapping_folio() passing NULL file, which causes a NULL pointer dereference in fuse_read_args_fill. To avoid this issue, need to add a check for file in fuse_read_folio(). [1] KASAN: null-ptr-deref in range [0x0000000000000060-0x0000000000000067] CPU: 3 UID: 0 PID: 5947 Comm: syz-executor314 Not tainted 6.12.0-rc5-syzkaller-00044-gc1e939a21eb1 #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 RIP: 0010:fuse_read_args_fill fs/fuse/file.c:631 [inline] RIP: 0010:fuse_do_readpage+0x276/0x640 fs/fuse/file.c:880 Code: e8 9f c7 91 fe 8b 44 24 10 89 44 24 78 41 89 c4 e8 8f c7 91 fe 48 8d 7b 60 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 1d 03 00 00 48 b8 00 00 00 00 00 fc ff df 48 8b RSP: 0018:ffffc90006a0f820 EFLAGS: 00010206 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff82fbb4c9 RDX: 000000000000000c RSI: ffffffff82fbb4f1 RDI: 0000000000000060 RBP: 0000000000000000 R08: 0000000000000007 R09: 7fffffffffffffff R10: 0000000000000fff R11: ffffffff961d4b88 R12: 0000000000001000 R13: ffff8880382b8000 R14: ffff888025153780 R15: ffffc90006a0f8b8 FS: 00007f7583f3d6c0(0000) GS:ffff88806a900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020000240 CR3: 0000000030d30000 CR4: 0000000000352ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> fuse_read_folio+0xb0/0x100 fs/fuse/file.c:905 filemap_read_folio+0xc6/0x2a0 mm/filemap.c:2367 do_read_cache_folio+0x263/0x5c0 mm/filemap.c:3825 read_mapping_folio include/linux/pagemap.h:1011 [inline] erofs_bread+0x34d/0x7e0 fs/erofs/data.c:41 erofs_read_superblock fs/erofs/super.c:281 [inline] erofs_fc_fill_super+0x2b9/0x2500 fs/erofs/super.c:625 vfs_get_super fs/super.c:1280 [inline] get_tree_nodev+0xda/0x190 fs/super.c:1299 erofs_fc_get_tree+0x1fe/0x2e0 fs/erofs/super.c:723 vfs_get_tree+0x8f/0x380 fs/super.c:1800 do_new_mount fs/namespace.c:3507 [inline] path_mount+0x14e6/0x1f20 fs/namespace.c:3834 do_mount fs/namespace.c:3847 [inline] __do_sys_mount fs/namespace.c:4057 [inline] __se_sys_mount fs/namespace.c:4034 [inline] __x64_sys_mount+0x294/0x320 fs/namespace.c:4034 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Reported-and-tested-by: syzbot+0b1279812c46e48bb0c1@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=0b1279812c46e48bb0c1 Signed-off-by: Lizhi Xu <lizhi.xu@windriver.com> --- fs/fuse/file.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)