[PATCH] btrfs: fix a NULL pointer dereference during device scan

[PATCH] btrfs: fix a NULL pointer dereference during device scan

[fdmanana]

From: Filipe Manana <fdmanana@suse.com>

At device_list_add(), we dereference a device's name inside a
btrfs_info_in_rcu() that is executed in a branch that can be triggered
when the device's name field is NULL, which obviously results in a NULL
pointer dereference as rcu_str_deref() tries to access the ->str
attribute of a NULL pointer to a struct rcu_string.

Fix that by not dereferencing the name if it's NULL, and instead print
the string "<unknown>".

Link: https://lore.kernel.org/linux-btrfs/00000000000066b78e05d94df48b@google.com/
Reported-by: syzbot+82650a4e0ed38f218363@syzkaller.appspotmail.com
Signed-off-by: Filipe Manana <fdmanana@suse.com>
---
 fs/btrfs/volumes.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index fa7fee09e39b..f662423fbeb7 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -940,7 +940,9 @@ static noinline struct btrfs_device *device_list_add(const char *path,
 			}
 			btrfs_info_in_rcu(device->fs_info,
 	"devid %llu device path %s changed to %s scanned by %s (%d)",
-					  devid, rcu_str_deref(device->name),
+					  devid, device->name ?
+					  rcu_str_deref(device->name) :
+					  "<unknown>",
 					  path, current->comm,
 					  task_pid_nr(current));
 		}
-- 
2.33.0

Re: [PATCH] btrfs: fix a NULL pointer dereference during device scan

[Filipe Manana]

On Thu, Mar 03, 2022 at 11:25:55AM +0000, fdmanana@kernel.org wrote:
> From: Filipe Manana <fdmanana@suse.com>
> 
> At device_list_add(), we dereference a device's name inside a
> btrfs_info_in_rcu() that is executed in a branch that can be triggered
> when the device's name field is NULL, which obviously results in a NULL
> pointer dereference as rcu_str_deref() tries to access the ->str
> attribute of a NULL pointer to a struct rcu_string.
> 
> Fix that by not dereferencing the name if it's NULL, and instead print
> the string "<unknown>".
> 
> Link: https://lore.kernel.org/linux-btrfs/00000000000066b78e05d94df48b@google.com/
> Reported-by: syzbot+82650a4e0ed38f218363@syzkaller.appspotmail.com
> Signed-off-by: Filipe Manana <fdmanana@suse.com>
> ---
>  fs/btrfs/volumes.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
> index fa7fee09e39b..f662423fbeb7 100644
> --- a/fs/btrfs/volumes.c
> +++ b/fs/btrfs/volumes.c
> @@ -940,7 +940,9 @@ static noinline struct btrfs_device *device_list_add(const char *path,
>  			}
>  			btrfs_info_in_rcu(device->fs_info,
>  	"devid %llu device path %s changed to %s scanned by %s (%d)",
> -					  devid, rcu_str_deref(device->name),
> +					  devid, device->name ?
> +					  rcu_str_deref(device->name) :
> +					  "<unknown>",

Taking a better look, device->name shouldn't ever be NULL here because
we have checked device->bdev is set.

So drop this change.

Thanks.

>  					  path, current->comm,
>  					  task_pid_nr(current));
>  		}
> -- 
> 2.33.0
> 

Re: [PATCH] btrfs: fix a NULL pointer dereference during device scan

[Anand Jain]

On 03/03/2022 19:25, fdmanana@kernel.org wrote:
> From: Filipe Manana <fdmanana@suse.com>
> 
> At device_list_add(), we dereference a device's name inside a
> btrfs_info_in_rcu() that is executed in a branch that can be triggered
> when the device's name field is NULL, which obviously results in a NULL
> pointer dereference as rcu_str_deref() tries to access the ->str
> attribute of a NULL pointer to a struct rcu_string.


A few lines above check if the device has the bdev, which means the
device->name can not be null.

925 if (device->bdev) {

Any idea how the test case could able to reach this condition?

Thanks, Anand


> Fix that by not dereferencing the name if it's NULL, and instead print
> the string "<unknown>".
> 
> Link: https://lore.kernel.org/linux-btrfs/00000000000066b78e05d94df48b@google.com/




> Reported-by: syzbot+82650a4e0ed38f218363@syzkaller.appspotmail.com
> Signed-off-by: Filipe Manana <fdmanana@suse.com>
> ---
>   fs/btrfs/volumes.c | 4 +++-
>   1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
> index fa7fee09e39b..f662423fbeb7 100644
> --- a/fs/btrfs/volumes.c
> +++ b/fs/btrfs/volumes.c
> @@ -940,7 +940,9 @@ static noinline struct btrfs_device *device_list_add(const char *path,
>   			}
>   			btrfs_info_in_rcu(device->fs_info,
>   	"devid %llu device path %s changed to %s scanned by %s (%d)",
> -					  devid, rcu_str_deref(device->name),
> +					  devid, device->name ?
> +					  rcu_str_deref(device->name) :
> +					  "<unknown>",
>   					  path, current->comm,
>   					  task_pid_nr(current));
>   		}

Re: [PATCH] btrfs: fix a NULL pointer dereference during device scan

[Filipe Manana]

On Thu, Mar 03, 2022 at 08:46:46PM +0800, Anand Jain wrote:
> On 03/03/2022 19:25, fdmanana@kernel.org wrote:
> > From: Filipe Manana <fdmanana@suse.com>
> > 
> > At device_list_add(), we dereference a device's name inside a
> > btrfs_info_in_rcu() that is executed in a branch that can be triggered
> > when the device's name field is NULL, which obviously results in a NULL
> > pointer dereference as rcu_str_deref() tries to access the ->str
> > attribute of a NULL pointer to a struct rcu_string.
> 
> 
> A few lines above check if the device has the bdev, which means the
> device->name can not be null.

Right. I noticed that later and had replied about that before.
Thanks.

> 
> 925 if (device->bdev) {
> 
> Any idea how the test case could able to reach this condition?
> 
> Thanks, Anand
> 
> 
> > Fix that by not dereferencing the name if it's NULL, and instead print
> > the string "<unknown>".
> > 
> > Link: https://lore.kernel.org/linux-btrfs/00000000000066b78e05d94df48b@google.com/
> 
> 
> 
> 
> > Reported-by: syzbot+82650a4e0ed38f218363@syzkaller.appspotmail.com
> > Signed-off-by: Filipe Manana <fdmanana@suse.com>
> > ---
> >   fs/btrfs/volumes.c | 4 +++-
> >   1 file changed, 3 insertions(+), 1 deletion(-)
> > 
> > diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
> > index fa7fee09e39b..f662423fbeb7 100644
> > --- a/fs/btrfs/volumes.c
> > +++ b/fs/btrfs/volumes.c
> > @@ -940,7 +940,9 @@ static noinline struct btrfs_device *device_list_add(const char *path,
> >   			}
> >   			btrfs_info_in_rcu(device->fs_info,
> >   	"devid %llu device path %s changed to %s scanned by %s (%d)",
> > -					  devid, rcu_str_deref(device->name),
> > +					  devid, device->name ?
> > +					  rcu_str_deref(device->name) :
> > +					  "<unknown>",
> >   					  path, current->comm,
> >   					  task_pid_nr(current));
> >   		}
>