From patchwork Tue Dec 13 08:11:03 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jun Nie X-Patchwork-Id: 32670 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:adf:f944:0:0:0:0:0 with SMTP id q4csp2699022wrr; Tue, 13 Dec 2022 00:15:53 -0800 (PST) X-Google-Smtp-Source: AA0mqf5tlcWPWwnlpVmQPEWHEDoMYBlOaj4P67XGbf864rcXgdedil/0Ci2NuKQEC1vOZlT3KIST X-Received: by 2002:a17:906:2bd7:b0:7c1:4c46:30a0 with SMTP id n23-20020a1709062bd700b007c14c4630a0mr11794160ejg.65.1670919353661; Tue, 13 Dec 2022 00:15:53 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1670919353; cv=none; d=google.com; s=arc-20160816; b=UCRUlKyRyYGsFegzlCSXwn5LJRw1JDZwydmhJppa8Wm4lsDLG3R+1kwHIHIdJfCy/k V97JYQ+EEDN1NTKKDUk6uE1ED59U/f9gYX85zjj6jewiueuESxy3KbQwn4Rp9u6s7PRo qq6Z+xBruYVTerc8Bpoaht39YwigCHI3T7KbrVCEUZtKaOB68rHErixIkmtfsdq0CJg0 4qxyzOEZwrv05Nf/8ZckpHH2b4rU7N8jJuvf6eJUDmWaK8u+usyJLaYxFVCocNpTGqvr iaQ02l/xXD5riX6Vb4rQkhQtYiQMQt/0stsCqTltTSp+4gvUt02qV7vcrnG7NsETQWk/ t+jw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:to:from:dkim-signature; bh=LdixbUsDgZBRFhhWcpEMBV8T7dpZCUPI7rjUYbSLzrM=; b=0QdwlgNEOhEbexS1Oraj4mfx7RGHNuNX6dS7/5dsTLwRXN0rPhgLKwuj2koZhq46VZ Y0xgSgNxCOcokHTwECvUu+ZKn891hGpDlzbc5w8nARDwUNuKaDlEwdC5bUW13INZaSX0 qQBjDhzQHnZExaUhrJA/rvTLAJHWVpqHx5/2JWTExLKUx5GQMBH4LSjWCTS38GHhBerI DQPv3d3W3fkYc5fg9XoDQT3srfHD9wYbHtjTRpGMvrSkaLPPr9HfC+4go7UWKlLVexGe qsE818jSfOY5Spvi72FPrDyZ0MjCe45syNLjUFziOdcC/86yIED58DKlDz7P79S7SJN2 reAg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=udcno0lD; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id l3-20020a170907914300b007bf1a8419b1si5953148ejs.519.2022.12.13.00.15.29; Tue, 13 Dec 2022 00:15:53 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=udcno0lD; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234687AbiLMILh (ORCPT + 99 others); Tue, 13 Dec 2022 03:11:37 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37406 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234583AbiLMILN (ORCPT ); Tue, 13 Dec 2022 03:11:13 -0500 Received: from mail-pj1-x1035.google.com (mail-pj1-x1035.google.com [IPv6:2607:f8b0:4864:20::1035]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C8B6317E34 for ; Tue, 13 Dec 2022 00:11:12 -0800 (PST) Received: by mail-pj1-x1035.google.com with SMTP id t11-20020a17090a024b00b0021932afece4so2701254pje.5 for ; Tue, 13 Dec 2022 00:11:12 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=content-transfer-encoding:mime-version:message-id:date:subject:to :from:from:to:cc:subject:date:message-id:reply-to; bh=LdixbUsDgZBRFhhWcpEMBV8T7dpZCUPI7rjUYbSLzrM=; b=udcno0lDcEMVMXQpTnhDi/Iy/Bnh+y+OyDrCwV/6DKlKH/rDyWjlhUElau3iKhH9gc iLXIP1e+JK+6T3aI+Z5doWUSOiwMAIMj8kIAc8wSJzw8DsjbnHJhPZtaQ7pnH0III6z9 8isv63T3WDzVyOYEZBiY0B+/knY2IQREMpo4MYikJc2BxXtGulXDOLbPQU51EzYdy+UM HhYDCSEfnQ5q1j8wbx6MBB78q5HsirhWKOHmB1o0e6Hm1iVpW2ir+DxNEDxls/vP6Ptt 7+Hf+4cJQ20dK10UViRSN9xhQt3TryrXvWWbJsYEubrszJ7ZiVTcTKWmclgCmygNsjK8 4XUg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:message-id:date:subject:to :from:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=LdixbUsDgZBRFhhWcpEMBV8T7dpZCUPI7rjUYbSLzrM=; b=X31MGpmBXlZ9Qjzjm8buq2+QpgCgJ+IWQxpCyvAiIQBHrM9tse2DW4DsLkZW1ASya4 +KtR0opz4A4hAt038mNpcAXSZlOlaooun7At0Da0sF/LcVYx2biiiuEE3jVVHCI5tCdB FfZE6/DPlgYaLsfLokZes+o2hdvnfp6BaJtwaBW0lCYEFriu5tNSQ8cvqd9nQFwoC5+P lMiGRlmVz3I8t8E8UerTEpuotB/ESVMBTtvz3LDo50xUkJqtvYZ9b1uODR58Wwaqm7OK sC47VH1PJgfqs2Go4L4zVaRSWVORcl5d0IL9MDwmeEn9ljtS4WA7tiIjEfdhs4IlPPDe EvdA== X-Gm-Message-State: ANoB5pkuHgt0W3upD7tR6T8ujwUQU5cdtwj1jUijB9TqXtsR3NplWUa8 Uh7gzXBpXnDy0EluPUWlQrhMdFs+iCss5JKu X-Received: by 2002:a17:90b:198e:b0:219:cb6d:7b0b with SMTP id mv14-20020a17090b198e00b00219cb6d7b0bmr19147590pjb.44.1670919072227; Tue, 13 Dec 2022 00:11:12 -0800 (PST) Received: from niej-dt-7B47.. (80.251.214.228.16clouds.com. [80.251.214.228]) by smtp.gmail.com with ESMTPSA id m6-20020a17090a34c600b00219025945dcsm6747757pjf.19.2022.12.13.00.11.07 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 13 Dec 2022 00:11:11 -0800 (PST) From: Jun Nie To: tytso@mit.edu, jaegeuk@kernel.org, ebiggers@kernel.org, linux-fscrypt@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH] fscrypt: Fix null pointer when defer i_crypt_info Date: Tue, 13 Dec 2022 16:11:03 +0800 Message-Id: <20221213081103.2182231-1-jun.nie@linaro.org> X-Mailer: git-send-email 2.34.1 MIME-Version: 1.0 X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_NONE, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1752085932349488446?= X-GMAIL-MSGID: =?utf-8?q?1752085932349488446?= syzbot report below bug[1]. Fix it with checking null pointer before deferring i_crypt_info. [1] general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] CPU: 3 PID: 456 Comm: repro Not tainted 6.1.0+gc0daf896 #169 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 RIP: 0010:fscrypt_limit_io_blocks+0xfa/0x2c0 Call Trace: ext4_iomap_begin+0x6c5/0x7e0 ? asym_cpu_capacity_scan+0x6b0/0x6b0 ? ext4_iomap_begin_report+0x6b0/0x6b0 ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 ? ext4_commit_super+0x3c1/0x560 ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 ? ext4_handle_error+0x3bf/0x6b0 ? ext4_iomap_begin_report+0x6b0/0x6b0 iomap_iter+0x538/0xc80 iomap_bmap+0x1ed/0x2d0 ? iomap_to_fiemap+0x220/0x220 ? rwsem_down_read_slowpath+0xc00/0xc00 ? __ext4_iget+0x19c/0x4370 ext4_bmap+0x288/0x470 ? mpage_prepare_extent_to_map+0xd80/0xd80 bmap+0xb1/0x120 jbd2_journal_init_inode+0x7d/0x3f0 ? up_write+0x6c/0xb0 ? jbd2_journal_init_dev+0x130/0x130 ? register_shrinker+0x33/0x160 ext4_fill_super+0xa467/0xc650 ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 ? ext4_reconfigure+0x2ad0/0x2ad0 ? snprintf+0xbb/0xf0 ? vsprintf+0x40/0x40 ? up_write+0x6c/0xb0 ? __sanitizer_cov_trace_cmp4+0x16/0x20 ? set_blocksize+0x2f0/0x380 get_tree_bdev+0x438/0x740 ? get_tree_bdev+0x438/0x740 ? ext4_reconfigure+0x2ad0/0x2ad0 ext4_get_tree+0x1d/0x30 vfs_get_tree+0x88/0x2e0 path_mount+0x6ca/0x1ec0 ? putname+0x110/0x150 ? finish_automount+0x790/0x790 ? putname+0x115/0x150 __x64_sys_mount+0x2aa/0x340 ? copy_mnt_ns+0xab0/0xab0 ? __sanitizer_cov_trace_cmp4+0x16/0x20 ? exit_to_user_mode_prepare+0x40/0x120 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Fixes: 5fee36095cda ("fscrypt: add inline encryption support") Reported-by: syzbot+ba9dac45bc76c490b7c3@syzkaller.appspotmail.com Signed-off-by: Jun Nie --- fs/crypto/inline_crypt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/crypto/inline_crypt.c b/fs/crypto/inline_crypt.c index cea8b14007e6..fec859e83774 100644 --- a/fs/crypto/inline_crypt.c +++ b/fs/crypto/inline_crypt.c @@ -232,7 +232,7 @@ void fscrypt_destroy_inline_crypt_key(struct super_block *sb, bool __fscrypt_inode_uses_inline_crypto(const struct inode *inode) { - return inode->i_crypt_info->ci_inlinecrypt; + return inode->i_crypt_info && inode->i_crypt_info->ci_inlinecrypt; } EXPORT_SYMBOL_GPL(__fscrypt_inode_uses_inline_crypto);